Concat time field to include start to end of hour

[benj851]

Hello; 

I've tried a few ways, but have been unsuccessful in creating a _time field to include the datetime, and the end hour. Ex. 06/18/2021 08:00 - 08:59. I'd appreciate any assistance in getting there. 

When concating, the time field converts to unix. Then I can't convert it back to CTIME. 

Here's an example of the data pulled: 

index=foo host=hostfoo sourcetype=sourcefoo
| bin span=1h _time
| table _time

_time

2021-06-18 08:00

Desired: 

_time

2021-06-18 08:00 - 08:59

[aasabatini · Accepted solution]

Hi @benj851 

try like this

<your search>
| eval date=strftime(_time, "%Y/%m/%d %H:%M")
| eval hour=strftime(_time, "%H")
| eval timestamp=date." "."-"." ".hour.":"."59"

[benj851]

Perfect thank you.