How do I round the time to up/down to the nearest hour?

[darls15]

Hi

I'm fairly new to Splunk and I need to round my time field up/down to the nearest hour.

For example...

If now returns 09:26:52 I want it to be rounded to 09:00:00, if the time is 14:36:18 then 15:00:00.

I have searched and can't find or understand how to do this. Is there someone help me with how?

Thanks

[niketn · Accepted solution]

@darls15 , if now is your field you can try the following to round off hours time. However some case()may need to be added/changed as per your use case.

<yourCurrentSearch>
| rex field=now "(?<Hour>[^:]+):(?<Minute>[^:]+):(?<Seconds>\d+)"
| eval rounded_hour=case(Seconds>30 AND Minute>29,Hour+1,
                         Minute>30,Hour+1,
                         true(),Hour).":00".":00"

Following is run anywhere example you can use to test:

| makeresults 
| eval now="14:36:18"
| rex field=now "(?<Hour>[^:]+):(?<Minute>[^:]+):(?<Seconds>\d+)"
| eval rounded_hour=case(Seconds>30 AND Minute>29,Hour+1,
                         Minute>30,Hour+1,
                         true(),Hour).":00".":00"

Above computes 09:29:31 as 09:00:00,
09:30:00 as 09:00:00,
09:30:30 as 09:00:00
but 09:30:31 as 10:00:00.
09:31:00 as 10:00:00,
and 09:31:31 as 10:00:00
So in case your expectations are different. Please change as per your needs.

[junweii]

Hi @niketn,

I'm fairly new to Splunk but what if I need to round my time field up/down to the nearest 5th minute.

For example...

My time field returns 02/24/2022 09:26:52 I want it to be rounded to 02/24/2022 09:25:00, and if the time is 02/24/2022 14:58:10 then 02/24/2022 15:00:00.

[darls15]

Thank you so much niketnilay ... works perfectly!