Is it possible to round the current time in a quarter of hour ( quarter superior)?

[jip31]

Hi

Is it possible to round the current time in a quarter of hour ( quarter superior)

For exemple if its 9h56 i would like to diplay 10:00 and 11:42 i would like to display 11:45

Thanks

[ITWhisperer]

| eval _time=_time+(15*30)-1
| bin _time span=15m
| fieldformat _time=strftime(_time,"%H:%M")

[jip31]

it works fine but i need to do the same thing from the currnt time...

[ITWhisperer]

| eval current=now()+(15*30)-1
| bin current span=15m
| fieldformat current=strftime(current,"%H:%M")

[jip31]

it seems to be what I need

but when I compare the current time with the past time (see my where clause) it displays nothing

`index` sourcetype="session"  earliest=-7d@d+7h latest=-7d@d+19h 
| bin _time span=15m 
| eval time=strftime(_time,"%H:%M") 
| stats dc(s) as s by time 
| eval current=now()+(15*30)-1 
| bin current span=15m 
| fieldformat current=strftime(current,"%H:%M") 
| where time=current
| table s time current

 it's strange because I can see data on the same slot time

[ITWhisperer · Accepted solution]

fieldformat doesn't change the value of the field, it just changes the way the field is display. Change it to

| eval current=strftime(current,"%H:%M")

[jip31]

perfect ITWhisperer, thanks

[DanielPriceUK]

Remainder=Time % 900
Time=Time-Remainder
If Reminder >=450 then Time=Time+900

You can do each step here with the splunk Eval command.

Time needs to be in Unix: here the docs to help with that https://docs.splunk.com/Documentation/SCS/current/SearchReference/DateandTimeFunctions

[jip31]

Hi

So if i well understand i cant have a date in H:M: format?

[DanielPriceUK]

you can use  the functions, strftime and strptime to change between formats.
you can read about them here.
https://docs.splunk.com/Documentation/SCS/current/SearchReference/DateandTimeFunctions