Hi all ,
I basically want to snap my time to the nearest 30 min. Like round of the the 30min.
Example :
1) TIME_NOW = 12:45 , earlier 30min is 12:30
2) TIME_NOW= 12:59 , earlier 30min is 12:30
3) TIME_NOW = 1:01 , earlier 30min is 1:00
thanks in advance
I converted it into time and used BIN.
| makeresults |eval TIME_NOW = "12:45"
| append [| makeresults |eval TIME_NOW = "12:55"]
| append [| makeresults |eval TIME_NOW = "13:01"]
| eval TIME_NOW=strptime(TIME_NOW,"%H:%M")
| bin TIME_NOW span=30m|stats count by TIME_NOW
| eval TIME_NOW=strftime(TIME_NOW,"%H:%M")
Is there a way i can do this on the time range picker
I have no idea what you mean.
i just want to round of the time now to the earliest 30min,
example the time now is 12:45, the time that it will get is 12:30.
can this be done on the time range picker itself
Just add this to your search:
... | bucket TIME_NOW span=30m@m
I converted it into time and used BIN.
| makeresults |eval TIME_NOW = "12:45"
| append [| makeresults |eval TIME_NOW = "12:55"]
| append [| makeresults |eval TIME_NOW = "13:01"]
| eval TIME_NOW=strptime(TIME_NOW,"%H:%M")
| bin TIME_NOW span=30m|stats count by TIME_NOW
| eval TIME_NOW=strftime(TIME_NOW,"%H:%M")