I assume you meant _time , not time ; if so, like this:
index="commercial_performance" $month_token$ $Customer_token$ Cat1="Efficiency " OR Cat1="Intervention " OR Cat1="Entitlement " | timechart span=1mon limit=0 sum(Value) AS "Total" | addtotals | eval Total_G=if(Total>0,Total,0) | eval Total_R=if(Total_G=0,Total,0) | fieldformat _time=strftime(_time, "%B") | table _time Total
... View more