Time & Date Query Functions
LogScale's time and date functions manipulate or format time information from events.
Table: Time & Date Query Functions
| Function | Default Argument | Availability | Description |
|---|---|---|---|
end([as]) | as |
Assign the end of the search time interval to the field provided
by parameter as.
| |
findTimestamp([addErrors], [as], [field], [timezone], [timezoneAs]) | Finds timestamp in given field and parses, trying multiple timestamp formats. | ||
now([as]) | as |
Assign the current time to the field provided by parameter
as.
| |
parseTimestamp([addErrors], [as], [caseSensitive], field, [format], [timezone], [timezoneAs]) | format | Parses a string into a timestamp. | |
start([as]) | as |
Assign the start of the search time interval to the field provided
by parameter as.
| |
time:dayOfMonth([as], [field], [timezone], [timezoneField]) | field | Gets the day of the month of a timestamp field. | |
time:dayOfWeek([as], field, [timezone], [timezoneField]) | field | Gets day of week from 1 (Mon) to 7 (Sun) of a timestamp. | |
time:dayOfWeekName([as], [field], [timezone], [timezoneField]) | field | Gets the English display name of day of the week of a timestamp field. | |
time:dayOfYear([as], [field], [timezone], [timezoneField]) | field | Gets the day of the year of a timestamp field, from 1 to 365, or 366 in a leap year. | |
time:hour([as], [field], [timezone], [timezoneField]) | field | Gets the hour (24-hour clock) of a timestamp field. | |
time:millisecond([as], [field], [timezone], [timezoneField]) | field | Gets the millisecond of a timestamp field. | |
time:minute([as], [field], [timezone], [timezoneField]) | field | Gets the minute value of a timestamp field. | |
time:month([as], [field], [timezone], [timezoneField]) | field | Gets the month of a timestamp field (from 1 to 12). | |
time:monthName([as], [field], [timezone], [timezoneField]) | field | Gets the English name of month of a timestamp field (e.g., January). | |
time:second([as], [field], [timezone], [timezoneField]) | field | Gets the second of a timestamp field. | |
time:weekOfYear([as], [field], [timezone], [timezoneField]) | field | Gets the week number within a year of a timestamp, a value from 1 to 53. | |
time:year([as], [field], [timezone], [timezoneField]) | field | Gets the year of a timestamp field. |