Evaluate now() function stored in token

[pedropiin]

Hi everyone.

I have a token called "schedule_dttm" that has two attributes: "earliest" and "latest". By default, "schedule_dttm.latest" is initialized with "now()", but it can hold data in three different formats: the "now" I just mentioned, a specific epoch timestamp and a relative timestamp such as "-1h@h".

My goal is to convert all of them to epoch timestamp, so the second case is trivial for me. But how do I (1) check which format is the date in and (2) create a logic to convert it properly conditionally based on the format its at?

Thanks in advance,
Pedro

[bowesmana]

A typical way to do this is via a background search that uses the actual time token to run the search and then set tokens based on addinfo output which gives you info_min and max times, e.g.

<search>
  <query>
| makeresults
| addinfo
  </query>
  <earliest>$schedule_dttm.earliest$</earliest>
  <latest>$schedule_dttm.latest$</latest>
  <done>
    <set token="schedule_dttm_epoch_earliest">$result.info_min_time$</set>
    <set token="schedule_dttm_epoch_latest">$result.info_max_time$</set>
  </done>
</search>

then you just use the new tokens in searches.

You can also do a similar thing with a subsearch by using addinfo to get the actual converted time and returning earliest and latest fields from the subsearch, but that's not the same as saving the epoch values.

[richgalloway]

Try an eval element with a case function.

<eval token="foo">case(schedule_dttm.latest="now", now(), is_num(schedule_dttm.latest), schedule_dttm.latest, 1==1, relative_time(now(), schedule_dttm.latest)</eval>