How to use macros to set time variable

[leonheart78]

Hi,

I'm trying to configure macros to use as a variable in my source. In my macro, I use strftime(relative_time(time(), "-1d"), "%Y%m%d%H"), to get it to print the date string in YYYYMMDDHH, which HH is the previous hour, but it doesn't seems to work.

Is there anything I got wrong?
Thanks.

[woodcock · Accepted solution]

I think the main problem is that you are using "-1d" instead of "-1h". In any case, it should look like this in macros.conf:

[TimeLessOneHour(2)]
args = OldTime, NewTime
definition = eval $NewTime$ = strftime(relative_time($OldTime$, "-1h"), "%Y%m%d%H")

And you should call it like this:

... |`TimeLessOneHour(_time, time)` | ...

Also beware that you must pass in an epoch time for OldTime or it will not work because relative_time requires epoch.

[leonheart78]

Hi,

Thanks for your reply. My purpose of setting the macros is to print out the date_time variable to identify the source, which is a filename, named in YYYYMMDDHH. I'm trying to achieve here is to search index=set source='ytd1hourago' where the ytd11hourago is the macro name for printing out the date which is ytd 1 hour ago. It could be "index-set source=20150810. May I know how can I achieve that through macros?

Thank you.

Leon

[woodcock]

OK, then my answer stands, except that (if I undersand you correctly), you would use it like this:

index=set [| noop | stats count | `TimeLessOneHour(now(), source)` | fields source]

This will normalize down to a search string that says this (but the date will obviously be different):

index=set source=20150810