https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-round-the-current-time-in-a-quarter-of-hour/m-p/596014#M207476 <LI-CODE lang="markup">| eval current=now()+(15*30)-1 | bin current span=15m | fieldformat current=strftime(current,"%H:%M")</LI-CODE> Sat, 30 Apr 2022 07:06:51 GMT ITWhisperer 2022-04-30T07:06:51Z https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-round-the-current-time-in-a-quarter-of-hour/m-p/595920#M207438 <P>Hi</P> <P>Is it possible to round the current time in a quarter of hour ( quarter superior)</P> <P>For exemple if its 9h56 i would like to diplay 10:00 and 11:42 i would like to display 11:45</P> <P>Thanks</P> Sat, 30 Apr 2022 19:36:00 GMT https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-round-the-current-time-in-a-quarter-of-hour/m-p/595920#M207438 jip31 2022-04-30T19:36:00Z https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-round-the-current-time-in-a-quarter-of-hour/m-p/595925#M207441 <P>Remainder=Time % 900<BR />Time=Time-Remainder<BR />If Reminder &gt;=450 then Time=Time+900</P><P>You can do each step here with the splunk Eval command.<BR /><BR />Time needs to be in Unix: here the docs to help with that&nbsp;<A href="https://docs.splunk.com/Documentation/SCS/current/SearchReference/DateandTimeFunctions" target="_blank" rel="noopener">https://docs.splunk.com/Documentation/SCS/current/SearchReference/DateandTimeFunctions</A></P> Fri, 29 Apr 2022 14:00:50 GMT https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-round-the-current-time-in-a-quarter-of-hour/m-p/595925#M207441 DanielPriceUK 2022-04-29T14:00:50Z https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-round-the-current-time-in-a-quarter-of-hour/m-p/595973#M207460 <P>Hi</P><P>So if i well understand i cant have a date in H:M: format?</P> Fri, 29 Apr 2022 16:33:03 GMT https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-round-the-current-time-in-a-quarter-of-hour/m-p/595973#M207460 jip31 2022-04-29T16:33:03Z https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-round-the-current-time-in-a-quarter-of-hour/m-p/595977#M207462 <LI-CODE lang="markup">| eval _time=_time+(15*30)-1 | bin _time span=15m | fieldformat _time=strftime(_time,"%H:%M")</LI-CODE> Fri, 29 Apr 2022 17:01:32 GMT https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-round-the-current-time-in-a-quarter-of-hour/m-p/595977#M207462 ITWhisperer 2022-04-29T17:01:32Z https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-round-the-current-time-in-a-quarter-of-hour/m-p/595978#M207463 <P>you can use&nbsp; the functions, strftime and strptime to change between formats.<BR />you can read about them here.<BR /><A href="https://docs.splunk.com/Documentation/SCS/current/SearchReference/DateandTimeFunctions" target="_blank">https://docs.splunk.com/Documentation/SCS/current/SearchReference/DateandTimeFunctions</A></P> Fri, 29 Apr 2022 17:02:59 GMT https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-round-the-current-time-in-a-quarter-of-hour/m-p/595978#M207463 DanielPriceUK 2022-04-29T17:02:59Z https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-round-the-current-time-in-a-quarter-of-hour/m-p/596012#M207474 <P>it works fine but i need to do the same thing from the currnt time...</P> Sat, 30 Apr 2022 04:24:46 GMT https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-round-the-current-time-in-a-quarter-of-hour/m-p/596012#M207474 jip31 2022-04-30T04:24:46Z https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-round-the-current-time-in-a-quarter-of-hour/m-p/596014#M207476 <LI-CODE lang="markup">| eval current=now()+(15*30)-1 | bin current span=15m | fieldformat current=strftime(current,"%H:%M")</LI-CODE> Sat, 30 Apr 2022 07:06:51 GMT https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-round-the-current-time-in-a-quarter-of-hour/m-p/596014#M207476 ITWhisperer 2022-04-30T07:06:51Z https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-round-the-current-time-in-a-quarter-of-hour/m-p/596017#M207477 <P>it seems to be what I need</P><P>but when I compare the current time with the past time (see my where clause) it displays nothing</P><LI-CODE lang="markup">`index` sourcetype="session" earliest=-7d@d+7h latest=-7d@d+19h | bin _time span=15m | eval time=strftime(_time,"%H:%M") | stats dc(s) as s by time | eval current=now()+(15*30)-1 | bin current span=15m | fieldformat current=strftime(current,"%H:%M") | where time=current | table s time current</LI-CODE><P>&nbsp;it's strange because I can see data on the same slot time</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="jip31_0-1651303312101.png" style="width: 731px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/19389i1A2F1B215037387A/image-dimensions/731x336?v=v2" width="731" height="336" role="button" title="jip31_0-1651303312101.png" alt="jip31_0-1651303312101.png" /></span></P><P>&nbsp;</P> Sat, 30 Apr 2022 07:22:23 GMT https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-round-the-current-time-in-a-quarter-of-hour/m-p/596017#M207477 jip31 2022-04-30T07:22:23Z https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-round-the-current-time-in-a-quarter-of-hour/m-p/596018#M207478 <P>fieldformat doesn't change the value of the field, it just changes the way the field is display. Change it to</P><LI-CODE lang="markup">| eval current=strftime(current,"%H:%M")</LI-CODE> Sat, 30 Apr 2022 07:25:46 GMT https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-round-the-current-time-in-a-quarter-of-hour/m-p/596018#M207478 ITWhisperer 2022-04-30T07:25:46Z https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-round-the-current-time-in-a-quarter-of-hour/m-p/596020#M207479 <P>perfect ITWhisperer, thanks</P> Sat, 30 Apr 2022 07:47:59 GMT https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-round-the-current-time-in-a-quarter-of-hour/m-p/596020#M207479 jip31 2022-04-30T07:47:59Z