Time & Date Query Functions

LogScale's time and date functions manipulate or format time information from events.

Table: Time & Date Query Functions

FunctionDefault ArgumentAvailabilityDescription
end([as])as  Assign the end of the search time interval to the field provided by parameter as.
findTimestamp([addErrors], [as], [field], [timezone], [timezoneAs])   Finds timestamp in given field and parses, trying multiple timestamp formats.
formatDuration([as], field, [from], [precision])field  Formats a duration into a more readable string.
now([as])as  Assign the current time to the field provided by parameter as.
parseTimestamp([addErrors], [as], [caseSensitive], field, [format], [timezone], [timezoneAs])format  Parses a string into a timestamp.
start([as])as  Assign the start of the search time interval to the field provided by parameter as.
time:dayOfMonth([as], [field], [timezone], [timezoneField])field  Gets the day of the month of a timestamp field.
time:dayOfWeek([as], field, [timezone], [timezoneField])field  Gets day of week from 1 (Mon) to 7 (Sun) of a timestamp.
time:dayOfWeekName([as], [field], [timezone], [timezoneField])field  Gets the English display name of day of the week of a timestamp field.
time:dayOfYear([as], [field], [timezone], [timezoneField])field  Gets the day of the year of a timestamp field, from 1 to 365, or 366 in a leap year.
time:hour([as], [field], [timezone], [timezoneField])field  Gets the hour (24-hour clock) of a timestamp field.
time:millisecond([as], [field], [timezone], [timezoneField])field  Gets the millisecond of a timestamp field.
time:minute([as], [field], [timezone], [timezoneField])field  Gets the minute value of a timestamp field.
time:month([as], [field], [timezone], [timezoneField])field  Gets the month of a timestamp field (from 1 to 12).
time:monthName([as], [field], [timezone], [timezoneField])field  Gets the English name of month of a timestamp field (for example, January).
time:second([as], [field], [timezone], [timezoneField])field  Gets the second of a timestamp field.
time:weekOfYear([as], [field], [timezone], [timezoneField])field  Gets the week number within a year of a timestamp, a value from 1 to 53.
time:year([as], [field], [timezone], [timezoneField])field  Gets the year of a timestamp field.