Assign the current time to the field provided by parameter as.

The time is represented as milliseconds since January 1, 1970 (UTC). In historical queries, the current time is when the query is issued. In live queries, the current time is when now() is processed for each event. The value, therefore, depends on where in the query now() is placed. If it is placed before the first aggregate function, it is only evaluated the first time the query sees the event. If it is placed after the first aggregate function, it is evaluated continuously, and gives the live value of the current system time, which can divert between LogScale nodes.

ParameterTypeRequiredDefaultDescription
as[a]stringoptional[b]_now Name of output field.

[a] The argument name as can be omitted.

[b] Optional parameters use their default value unless explicitly set

Omitted Argument Names

The argument name for as can be omitted; the following forms of this function are equivalent:

logscale
now("_now")

and:

logscale
now(as="_now")

now() Examples

Assign curr the value of now:

logscale
curr := now()

Use now() in an assignment:

logscale
isOld := (now()-@timestamp) > 1000