Need help with adding if condition between time

[srinivasgowda]

Hello all,

blacklist   blackout_end               blackout_start
1              1616756907                  1616756427
1              1616756907                  1616756427

I am trying to add the value for blacklist, where if the _time > blackout_start AND < blackout_end then blacklist=1 else 0.  

Please help in getting the right answer.

Thanks.

[aasabatini]

Hi

first you need to convert your timestamp in epoch

| eval epoch=strftime(_time, "%s") 

after this you can create your if condition, below you find the eval convertion and eval condition

| eval epoch=strftime(_time, "%s") | eval blacklist=if(blacklist_start > epoch AND epoch < blacklist_end,"1","0")

would be nice if you confirm the solution

Regards

[rnowitzki]

_time is stored as epoch internally and you can use it like that.
No need to convert it prior to the conditional eval.

[aasabatini]

epoch is stored on _time field but to works need convertions or blacklist_start/end field or time.

Regards

[rnowitzki]

Nope, you can use it as-is.

Doesn't really matter in this case, but I wanted to be sure I don't tell BS and tested it (again) 🙂 :



BR
Ralph

[rnowitzki]

Hi @srinivasgowda ,

Try this

| eval blacklist=if(_time > blackout_start AND _time < blackout_end,1,0)

Hope it works for you.
BR
Ralph