topic Re: Help converting time format and age in Getting Data In

Help converting time format and age

devsupport — Sun, 05 May 2019 21:32:28 GMT

I have a time format field "2019-05-02T19:43:00.0000000Z" and need two things: a) convert to y-m-d h:m:s format and b) calculate age (ex. older than 12 hours). What is the best approach to this? Thank you in advance.

Re: Help converting time format and age

MuS — Mon, 06 May 2019 01:30:11 GMT

Hi devsupport,

take a look at this search:

| makeresults 
| eval foo="2019-05-02T19:43:00.0000000Z", myEpoch=strptime(foo, "%Y-%m-%dT%H:%M:%S.%7NZ"), "a)"=strftime(myEpoch, "%Y-%m-%d %H:%M:%S"), "b)"=tostring(now() - myEpoch, "duration")

This will create the time stamp in your expected format and calculates the age since it occurred.

Hope this helps ...

cheers, MuS

Re: Help converting time format and age

devsupport — Mon, 06 May 2019 20:24:49 GMT

Thank you Mus. When running the query, the b column returns this: 3+17:35:59.000000

Can that number be changed to round to the nearest hour? Appreciate the help.

Re: Help converting time format and age

MuS — Mon, 06 May 2019 20:28:50 GMT

Well, try it with your real events. The provided answer has 2019-05-02T19:43:00.0000000Z hard coded.

cheers, MuS