Try like this
|rest /services/authentication/users splunk_server=local | eval updated=upper(strftime(strptime(substr(updated,1,10),"%Y-%m-%d"),"%B"))
|stats count by updated
Try like this
|rest /services/authentication/users splunk_server=local | eval updated=upper(strftime(strptime(substr(updated,1,10),"%Y-%m-%d"),"%B"))
|stats count by updated