I have a dbquery ouput that looks like the below, unfortunately i cant update the actual database query to make it more readable...
2022-12-16 21:30:17.689, TO_CHAR(schema.function(MAX(columnA)),'MM-DD-YYHH24:MI')="12-16-22 16:29"
I am trying to whether time the 2 times at the begining and end of the results are within 15 mins of each other. I have tried renaming the column from the long stupid string but i cant get that working using the rename function. does anyone have any ideas how to rename (or if i even need to) and then evaluate whether the times are within 15 mins of each other?
the query i ran to get the above is just <index="abc">
Use rex to extract the two timestamps then use strptime to convert them into epoch (integer) form. Then you can compare then to see how far apart they are.
| makeresults | eval _raw="2022-12-16 21:30:17.689, TO_CHAR(schema.function(MAX(columnA)),'MM-DD-YYHH24:MI')=\"12-16-22 16:29\""
```Above creates demo data. Delete IRL```
| rex "(?<time1>^\d\d\d\d-\d\d-\d\d \d\d:\d\d:\d\d.\d\d\d)"
| rex "(?<time2>\d\d-\d\d-\d\d \d\d:\d\d\\\")"
| eval diffsecs = strptime(time1, "%Y-%m-%d %H:%M:%S.%3N") - strptime(time2, "%m-%d-%y %H:%M")
| eval old=if(abs(diffsecs) > (15*60),1 ,0)
Use rex to extract the two timestamps then use strptime to convert them into epoch (integer) form. Then you can compare then to see how far apart they are.
| makeresults | eval _raw="2022-12-16 21:30:17.689, TO_CHAR(schema.function(MAX(columnA)),'MM-DD-YYHH24:MI')=\"12-16-22 16:29\""
```Above creates demo data. Delete IRL```
| rex "(?<time1>^\d\d\d\d-\d\d-\d\d \d\d:\d\d:\d\d.\d\d\d)"
| rex "(?<time2>\d\d-\d\d-\d\d \d\d:\d\d\\\")"
| eval diffsecs = strptime(time1, "%Y-%m-%d %H:%M:%S.%3N") - strptime(time2, "%m-%d-%y %H:%M")
| eval old=if(abs(diffsecs) > (15*60),1 ,0)
this is beautiful. thanks so much. it works perfectly.