How to change timestamp to include another field value?

[POR160893]

Hi,

I have an index with one field as a timestamp, "SESSION_TIME", and another field, "SEQUENCE". The "SEQUENCE" field is unique for each event and i am tasked to replace the seconds part of each timestamp with the respective "SEQUENCE" number.

This is what I currently wrote but I clearly wrote it incorrect:
eval xxx = strftime(SESSION_TIMESTAMP,"%S" = "SEQUENCE")

Can you please help?


Thanks,
Patrick

[POR160893]

The SESSION_timestamp is a String value like this 2022-04-20 12:23:43.
The SEQUENCE is an integer value like 101.
I need to replace the second part of each timestamp with the respective SEQUENCE value.
So, in this example, the value I would want is 2022-04-20 12:23:101.

Can you please help?

(I gave you Karma btw 😀)

[sperkins]

Convert the time to epoch, reformat it without the seconds, and then concatenate with strcat::
| eval time_epoch = strptime('SESSION_timestamp', "%Y-%m-%d %H:%M:%S")
| convert ctime(time_epoch) as hour_minute timeformat="%Y-%m-%d %H:%M"
| strcat hour_minute ":" SEQUENCE combo_time

combo_time= 2022-04-20 12:23:101

[POR160893]

When I run this query, it does not show the date before the SEQUENCE number ....

[sperkins]

Does the strptime format match the time format of the SESSION_timestamp in your data?

[POR160893]

No worries, this worked when I capitalised the field nameL

[sperkins]

Fantastic!! 

[POR160893]

SESSION_TIMESTAMP="2022-04-20 14:03:41" is the format

[sperkins]

Ahhh change the eval to capitalize the field name
| eval time_epoch = strptime(SESSION_TIMESTAMP, "%Y-%m-%d %H:%M:%S")

[isoutamo]

Hi

what is your actual issue which you are trying to solve? I suppose that you will get more issues with this e.g. when value of SEQUENCE is outside of 0 to 59?

Is your SESSION_TIME in epoc or human readable mode and if later what is the format?

r. Ismo

[POR160893]

The SESSION_timestamp is a String value like this 2022-04-20 12:23:43.
The SEQUENCE is an integer value like 101.
I need to replace the second part of each timestamp with the respective SEQUENCE value.
So, in this example, the value I would want is 2022-04-20 12:23:101.

Can you please help?

(I gave you Karma btw 

)