eval range=case( start_time=="ZERO_TIME","All Time",
start_time!="ZERO_TIME" AND ctime - strptime(start_time, "%a %b %d %H:%M:%S %Y") <= 300, "5 Minutes",
start_time!="ZERO_TIME" AND ctime - strptime(start_time, "%a %b %d %H:%M:%S %Y") <= 900
AND ctime - strptime(start_time, "%a %b %d %H:%M:%S %Y") > 300, "15 Minutes",
start_time!="ZERO_TIME" AND ctime - strptime(start_time, "%a %b %d %H:%M:%S %Y") <= 3600
AND ctime - strptime(start_time, "%a %b %d %H:%M:%S %Y") > 900, "1 Hour", start_time!="ZERO_TIME"
AND ctime - strptime(start_time, "%a %b %d %H:%M:%S %Y") <= 14400 AND ctime
- strptime(start_time, "%a %b %d %H:%M:%S %Y") > 3600, "4 Hours",
start_time!="ZERO_TIME"
AND ctime - strptime(start_time, "%a %b %d %H:%M:%S %Y") <= 86400
AND ctime - strptime(start_time, "%a %b %d %H:%M:%S %Y") > 14400, "1 Day", start_time!="ZERO_TIME"
AND ctime - strptime(start_time, "%a %b %d %H:%M:%S %Y") <= 3888000
AND ctime - strptime(start_time, "%a %b %d %H:%M:%S %Y") > 86400, "1-45 Days", start_time!="ZERO_TIME"
AND ctime - strptime(start_time, "%a %b %d %H:%M:%S %Y") > 3888000, "45 Days +", start_time==start_time, "Other")
Assuming ctime
is current time, try this. Once you've created the macro, use it like this crange(start_time)
[crange(1)]
args = start_time
eval range=case( $start_time$=="ZERO_TIME","All Time",
$start_time$!="ZERO_TIME" AND now() - strptime($start_time$, "%a %b %d %H:%M:%S %Y") <= 300, "5 Minutes",
$start_time$!="ZERO_TIME" AND now() - strptime($start_time$, "%a %b %d %H:%M:%S %Y") <= 900
AND now() - strptime($start_time$, "%a %b %d %H:%M:%S %Y") > 300, "15 Minutes",
$start_time$!="ZERO_TIME" AND now() - strptime($start_time$, "%a %b %d %H:%M:%S %Y") <= 3600
AND now() - strptime($start_time$, "%a %b %d %H:%M:%S %Y") > 900, "1 Hour", $start_time$!="ZERO_TIME"
AND now() - strptime($start_time$, "%a %b %d %H:%M:%S %Y") <= 14400 AND now()
- strptime($start_time$, "%a %b %d %H:%M:%S %Y") > 3600, "4 Hours",
$start_time$!="ZERO_TIME"
AND now() - strptime($start_time$, "%a %b %d %H:%M:%S %Y") <= 86400
AND now() - strptime($start_time$, "%a %b %d %H:%M:%S %Y") > 14400, "1 Day", $start_time$!="ZERO_TIME"
AND now() - strptime($start_time$, "%a %b %d %H:%M:%S %Y") <= 3888000
AND now() - strptime($start_time$, "%a %b %d %H:%M:%S %Y") > 86400, "1-45 Days", $start_time$!="ZERO_TIME"
AND now() - strptime($start_time$, "%a %b %d %H:%M:%S %Y") > 3888000, "45 Days +", $start_time$==$start_time$, "Other")
*OR* if ctime
is something else, try this and use it like this crange(start_time, ctime)
[crange(2)]
args = start_time, ctime
eval range=case( $start_time$=="ZERO_TIME","All Time",
$start_time$!="ZERO_TIME" AND $ctime$ - strptime($start_time$, "%a %b %d %H:%M:%S %Y") <= 300, "5 Minutes",
$start_time$!="ZERO_TIME" AND $ctime$ - strptime($start_time$, "%a %b %d %H:%M:%S %Y") <= 900
AND $ctime$ - strptime($start_time$, "%a %b %d %H:%M:%S %Y") > 300, "15 Minutes",
$start_time$!="ZERO_TIME" AND $ctime$ - strptime($start_time$, "%a %b %d %H:%M:%S %Y") <= 3600
AND $ctime$ - strptime($start_time$, "%a %b %d %H:%M:%S %Y") > 900, "1 Hour", $start_time$!="ZERO_TIME"
AND $ctime$ - strptime($start_time$, "%a %b %d %H:%M:%S %Y") <= 14400 AND $ctime$
- strptime($start_time$, "%a %b %d %H:%M:%S %Y") > 3600, "4 Hours",
$start_time$!="ZERO_TIME"
AND $ctime$ - strptime($start_time$, "%a %b %d %H:%M:%S %Y") <= 86400
AND $ctime$ - strptime($start_time$, "%a %b %d %H:%M:%S %Y") > 14400, "1 Day", $start_time$!="ZERO_TIME"
AND $ctime$ - strptime($start_time$, "%a %b %d %H:%M:%S %Y") <= 3888000
AND $ctime$ - strptime($start_time$, "%a %b %d %H:%M:%S %Y") > 86400, "1-45 Days", $start_time$!="ZERO_TIME"
AND $ctime$ - strptime($start_time$, "%a %b %d %H:%M:%S %Y") > 3888000, "45 Days +", $start_time$==$start_time$, "Other")
Here's how you can test it, after the macro is created. Change the value for x
| makeresults | eval x=45 | eval start_time=strftime(now()-x*2, "%a %b %d %H:%M:%S %Y") | eval ctime=now() | eval y=ctime - strptime(start_time, "%a %b %d %H:%M:%S %Y") | `crange(start_time, ctime)` | table x range ctime y start_time
If you are using CASE, then you never need to test for the opposite of a prior test. For example, with the first test being $start_time$=="ZERO_TIME", you don't need to ever test for$start_time$!="ZERO_TIME" in all the rest after that. Also, for each "less than x", you never have to test to make sure it's greater than that. So, for the first version of the code, the code simplifies to a much more readable version that looks something like this -
[crange(1)]
args = start_time
eval duration=IF( $start_time$=="ZERO_TIME",-1, now() - strptime($start_time$, "%a %b %d %H:%M:%S %Y"))
|
eval range=case(duration < 0,"All Time",
duration = 0,"Instant",
duration <= 300, "5 Minutes",
duration <= 900, "15 Minutes",
duration <= 3600, "1 Hour",
duration <= 14400,"4 Hours",
duration <= 86400, "1 Day",
duration <= 3888000, "1-45 Days",
duration > 3888000, "45 Days +" )
Assuming ctime
is current time, try this. Once you've created the macro, use it like this crange(start_time)
[crange(1)]
args = start_time
eval range=case( $start_time$=="ZERO_TIME","All Time",
$start_time$!="ZERO_TIME" AND now() - strptime($start_time$, "%a %b %d %H:%M:%S %Y") <= 300, "5 Minutes",
$start_time$!="ZERO_TIME" AND now() - strptime($start_time$, "%a %b %d %H:%M:%S %Y") <= 900
AND now() - strptime($start_time$, "%a %b %d %H:%M:%S %Y") > 300, "15 Minutes",
$start_time$!="ZERO_TIME" AND now() - strptime($start_time$, "%a %b %d %H:%M:%S %Y") <= 3600
AND now() - strptime($start_time$, "%a %b %d %H:%M:%S %Y") > 900, "1 Hour", $start_time$!="ZERO_TIME"
AND now() - strptime($start_time$, "%a %b %d %H:%M:%S %Y") <= 14400 AND now()
- strptime($start_time$, "%a %b %d %H:%M:%S %Y") > 3600, "4 Hours",
$start_time$!="ZERO_TIME"
AND now() - strptime($start_time$, "%a %b %d %H:%M:%S %Y") <= 86400
AND now() - strptime($start_time$, "%a %b %d %H:%M:%S %Y") > 14400, "1 Day", $start_time$!="ZERO_TIME"
AND now() - strptime($start_time$, "%a %b %d %H:%M:%S %Y") <= 3888000
AND now() - strptime($start_time$, "%a %b %d %H:%M:%S %Y") > 86400, "1-45 Days", $start_time$!="ZERO_TIME"
AND now() - strptime($start_time$, "%a %b %d %H:%M:%S %Y") > 3888000, "45 Days +", $start_time$==$start_time$, "Other")
*OR* if ctime
is something else, try this and use it like this crange(start_time, ctime)
[crange(2)]
args = start_time, ctime
eval range=case( $start_time$=="ZERO_TIME","All Time",
$start_time$!="ZERO_TIME" AND $ctime$ - strptime($start_time$, "%a %b %d %H:%M:%S %Y") <= 300, "5 Minutes",
$start_time$!="ZERO_TIME" AND $ctime$ - strptime($start_time$, "%a %b %d %H:%M:%S %Y") <= 900
AND $ctime$ - strptime($start_time$, "%a %b %d %H:%M:%S %Y") > 300, "15 Minutes",
$start_time$!="ZERO_TIME" AND $ctime$ - strptime($start_time$, "%a %b %d %H:%M:%S %Y") <= 3600
AND $ctime$ - strptime($start_time$, "%a %b %d %H:%M:%S %Y") > 900, "1 Hour", $start_time$!="ZERO_TIME"
AND $ctime$ - strptime($start_time$, "%a %b %d %H:%M:%S %Y") <= 14400 AND $ctime$
- strptime($start_time$, "%a %b %d %H:%M:%S %Y") > 3600, "4 Hours",
$start_time$!="ZERO_TIME"
AND $ctime$ - strptime($start_time$, "%a %b %d %H:%M:%S %Y") <= 86400
AND $ctime$ - strptime($start_time$, "%a %b %d %H:%M:%S %Y") > 14400, "1 Day", $start_time$!="ZERO_TIME"
AND $ctime$ - strptime($start_time$, "%a %b %d %H:%M:%S %Y") <= 3888000
AND $ctime$ - strptime($start_time$, "%a %b %d %H:%M:%S %Y") > 86400, "1-45 Days", $start_time$!="ZERO_TIME"
AND $ctime$ - strptime($start_time$, "%a %b %d %H:%M:%S %Y") > 3888000, "45 Days +", $start_time$==$start_time$, "Other")
Here's how you can test it, after the macro is created. Change the value for x
| makeresults | eval x=45 | eval start_time=strftime(now()-x*2, "%a %b %d %H:%M:%S %Y") | eval ctime=now() | eval y=ctime - strptime(start_time, "%a %b %d %H:%M:%S %Y") | `crange(start_time, ctime)` | table x range ctime y start_time
Thanks sundaresh. It works 🙂
What have you tried so far?