How to change the format of column timechart labels?

[dhavamanis]

Need your help,

We are aggregating data for 6 months and showing it in column charts to compare each year's data using the search below:

index="myindex" source="/opt/apps/myapp/views/myapp_PV_UV_Data_4.csv" |timechart sum(PAGE_VIEWS) as PageViews span=6mon | eval Timestamp=strftime(_time,"%m-%Y-%b-%Y") | table Timestamp PageViews | sort Timestamp | eval Timestamp=substr(Timestamp,9)

results showing as,

Jan-2013,Jan-2014,Jan2015,Jul-2013,Jul-2014,Jul-2015

It's showing correct results, but we want to modify the label in the below format:

Jan-Jun'2013,Jan-Jun'2014,Jan-Jun'2015,Jul-Dec'2013,Jul-Dec'2014,Jul-Dec'2015

Can you please help us how to do this.

[somesoni2 · Accepted solution]

Try something like this

 index="myindex" source="/opt/apps/myapp/views/myapp_PV_UV_Data_4.csv" |timechart sum(PAGE_VIEWS) as PageViews span=6mon | eval Timestamp=strftime(_time,"%m-%Y-%b-").strftime(relative_time(_time,"+5mon"),"%b'").strftime(_time,"%Y") | table Timestamp PageViews | sort Timestamp | eval Timestamp=substr(Timestamp,9)

[dhavamanis]

it works fine. thank you so much, just adjusted this alone strftime(relative_time(_time,"+5mon")