Can you help me SNAP to the nearest 30min?

[jadengoho]

Hi all ,

I basically want to snap my time to the nearest 30 min. Like round of the the 30min.

Example :
1) TIME_NOW = 12:45 , earlier 30min is 12:30
2) TIME_NOW= 12:59 , earlier 30min is 12:30
3) TIME_NOW = 1:01 , earlier 30min is 1:00

thanks in advance

[jadengoho]

HI, woodcock and Hiroshi Satoh,
I have tried it on doing on a query But I will be needing this on the time picker advance option.
Cause I will use it on both dashboard panel and save search settings.

[jadengoho]

Is there a way i can do this on the time range picker

[woodcock]

I have no idea what you mean.

[jadengoho]

i just want to round of the time now to the earliest 30min,
example the time now is 12:45, the time that it will get is 12:30.

can this be done on the time range picker itself

[woodcock]

Just add this to your search:

... | bucket TIME_NOW span=30m@m

[HiroshiSatoh · Accepted solution]

I converted it into time and used BIN.

| makeresults |eval TIME_NOW = "12:45"
| append [| makeresults |eval TIME_NOW = "12:55"]
| append [| makeresults |eval TIME_NOW = "13:01"]
| eval TIME_NOW=strptime(TIME_NOW,"%H:%M")
| bin TIME_NOW span=30m|stats count by TIME_NOW
| eval TIME_NOW=strftime(TIME_NOW,"%H:%M")