Need your help,
We are aggregating data for 6 months and showing it in column charts to compare each year's data using the search below:
index="myindex" source="/opt/apps/myapp/views/myapp_PV_UV_Data_4.csv" |timechart sum(PAGE_VIEWS) as PageViews span=6mon | eval Timestamp=strftime(_time,"%m-%Y-%b-%Y") | table Timestamp PageViews | sort Timestamp | eval Timestamp=substr(Timestamp,9)
results showing as,
Jan-2013,Jan-2014,Jan2015,Jul-2013,Jul-2014,Jul-2015
It's showing correct results, but we want to modify the label in the below format:
Jan-Jun'2013,Jan-Jun'2014,Jan-Jun'2015,Jul-Dec'2013,Jul-Dec'2014,Jul-Dec'2015
Can you please help us how to do this.
Try something like this
index="myindex" source="/opt/apps/myapp/views/myapp_PV_UV_Data_4.csv" |timechart sum(PAGE_VIEWS) as PageViews span=6mon | eval Timestamp=strftime(_time,"%m-%Y-%b-").strftime(relative_time(_time,"+5mon"),"%b'").strftime(_time,"%Y") | table Timestamp PageViews | sort Timestamp | eval Timestamp=substr(Timestamp,9)
Try something like this
index="myindex" source="/opt/apps/myapp/views/myapp_PV_UV_Data_4.csv" |timechart sum(PAGE_VIEWS) as PageViews span=6mon | eval Timestamp=strftime(_time,"%m-%Y-%b-").strftime(relative_time(_time,"+5mon"),"%b'").strftime(_time,"%Y") | table Timestamp PageViews | sort Timestamp | eval Timestamp=substr(Timestamp,9)
it works fine. thank you so much, just adjusted this alone strftime(relative_time(_time,"+5mon")