Date/Time functions¶

now¶

Returns the UNIX time when the search starts. Unlike other functions, this function does not take any argument.

Syntax:

| process eval("identifier=now()")

Example:

| process eval("search_time=now()")

Using now function¶

Here, the query returns the UNIX time of the search process in the search identifier.

relative_time¶

Accepts two arguments: a UNIX time X and a relative time specifier Y as input, and returns a UNIX time by adding or deducting the value of Y from the value of X.

Syntax:

| process eval("identifier=relative_time(X, Y)")

• The operator used in Y can be either + or -.

• The format specifier of time is s for a second, m for a minute, h for an hour, d for a day and w for a week.

Example:

| process eval("result=relative_time(now(), '+1d')")

Using relative time function¶

Here, the query adds time equivalent of 1 day or 24 hours to the current UNIX time and returns it in the result identifier.

strftime¶

Accepts a UNIX time X and returns the time as a string using the date and time format specified in Y. The UNIX time value must be in seconds.

Syntax:

| process eval("identifier=strftime(X, Y)")

Example:

| process eval("day_in_year=strftime(now(), 'DD')")

Using strftime function for day in year¶

Here, the query accepts the current UNIX time and returns the total number of days in a year in the day_in_year identifier.

Example:

| process eval("search_date=strftime(now(), 'YYYY/MM/dd')")

Using strftime function for day in month¶

Here, the query accepts the current UNIX time and displays the time in YYYY/MM/dd format in the search_date identifier.

The Timezone parameter in the strptime function converts date and time values based on timezone, defined by a fixed offset from Greenwich Mean Time (GMT). By default, the timezone of a machine is used for the conversion. It is an optional parameter.

Syntax:

GMTOffsetTimeZone:
            GMT Sign Hours : Minutes
    Sign: one of
            + -
    Hours:
            Digit
            Digit Digit
    Minutes:
            Digit Digit
    Digit: one of
            0 1 2 3 4 5 6 7 8 9

Example:

| process eval("identifier=strftime(now(), 'yyyy-MM-dd hh:mm:ss', 'GMT+4:45')")

strptime¶

Accepts a human readable time specified in X and converts it into a UNIX timestamp using the date and time format specified in Y.

Syntax:

| process eval("identifier=strptime(X, Y)")

Example:

| process eval("searchtime=strptime('2017-12-12', 'yyyy-mm-dd')")

Using strptime function¶

Here, the query accepts human readable time and converts it to a UNIX timestamp. It returns the converted time in the searchtime identifier.

The Timezone parameter in the strptime function converts date and time values based on timezone, defined by a fixed offset from Greenwich Mean Time (GMT). By default, the timezone of a machine is used for the conversion. It is an optional parameter.

Syntax:

GMTOffsetTimeZone:
            GMT Sign Hours : Minutes
    Sign: one of
            + -
    Hours:
            Digit
            Digit Digit
    Minutes:
            Digit Digit
    Digit: one of
            0 1 2 3 4 5 6 7 8 9

Example:

| process eval("identifier=strptime('2022-08-12', 'yyyy-MM-dd', 'GMT-9:45')")

time¶

Takes no argument and returns the UNIX time on which the eval process command processes the command. The returned time is the time when the eval command processed the event.

Syntax:

| process eval("identifier=time()")

Example:

| process eval("process_time=time()")

Using time function¶

Here, the query returns the time of the eval command execution in the process_time identifier.

Date/Time patterns¶

The list of all possible patterns in the date/time function.