Time Conversion

[mbasharat]

Hi,

I have time format as:
2019-10-08 15:24:40.132 UTC

I used eval to strip it to:
2019-10-08 15:24:40

I need to calculate Age. My eval is below but it is not working. Can someone assist pls?

| eval age=ceiling((now()-strptime(Event_Created_Time_Date,"%F %H:%M:%S"))/86400)

| eval Event_Age=case(
age<1,"1_Less than 1 Days",
age>=30,"6_Older than 30 Days",
age>=20,"5_Older than 20 Days",
age>=10,"4_Older than 10 Days",
age>=5,"3_Older than 5 Days",
age>=2,"2_Older than 2 Days",
0==0,"7_No Age Data")

[manjunathmeti · Accepted solution]

hi @mbasharat, For timezone (UTC) you can set variable "%Z".

Try this:

| makeresults 
| eval Event_Created_Time_Date="2019-10-08 15:24:40.132 UTC" 
| eval age=ceiling((now() - strptime(Event_Created_Time_Date, "%Y-%m-%d %H:%M:%S.%3N %Z"))/86400) 
| eval Event_Age=case(
    age<1,"1_Less than 1 Days",
    age>=30,"6_Older than 30 Days",
    age>=20,"5_Older than 20 Days",
    age>=10,"4_Older than 10 Days",
    age>=5,"3_Older than 5 Days",
    age>=2,"2_Older than 2 Days",
    0==0,"7_No Age Data")

[mbasharat]

THANK YOU!!!