_ time is in below format
2019-01-30 07:10:51.191
2019-01-30 07:10:51.190
2019-01-30 07:10:51.189
I need output in below format
January 2019
Any help would be highly appreciable...
Try this:
<your base search> | eval yourtime = strftime(_time,"%B %Y)
the field yourtime
will then contain the timestamp in the requested format.
Hello @sbhatnagar88
Try this:
index=_internal | head 1 | table _time | eval time= strftime(_time, "%B %Y")
Thank you...
Try this:
<your base search> | eval yourtime = strftime(_time,"%B %Y)
the field yourtime
will then contain the timestamp in the requested format.
Thank you...