Some timestamps use month numbers like "11" rather than strings like "Nov".
I'm using this eval to make the conversion:
| eval month=if(isnotnull(MM),if(MM="01","Jan",if(MM="02","Feb",if(MM="03","Mar",if(MM="04","Apr",if(MM="05","May",if(MM="06","Jun",if(MM="07","Jul",if(MM="08","Aug",if(MM="09","Sep",if(MM="10","Oct",if(MM="11","Nov",if(MM="12","Dec","INV")))))))))))),MM)
Is there a better way?
↧