Hi,
I'm trying to configure macros to use as a variable in my source. In my macro, I use strftime(relative_time(time(), "-1d"), "%Y%m%d%H")
, to get it to print the date string in YYYYMMDDHH
, which HH is the previous hour, but it doesn't seems to work.
Is there anything I got wrong?
Thanks.
I think the main problem is that you are using "-1d"
instead of "-1h"
. In any case, it should look like this in macros.conf:
[TimeLessOneHour(2)]
args = OldTime, NewTime
definition = eval $NewTime$ = strftime(relative_time($OldTime$, "-1h"), "%Y%m%d%H")
And you should call it like this:
... |`TimeLessOneHour(_time, time)` | ...
Also beware that you must pass in an epoch
time for OldTime
or it will not work because relative_time
requires epoch
.
I think the main problem is that you are using "-1d"
instead of "-1h"
. In any case, it should look like this in macros.conf:
[TimeLessOneHour(2)]
args = OldTime, NewTime
definition = eval $NewTime$ = strftime(relative_time($OldTime$, "-1h"), "%Y%m%d%H")
And you should call it like this:
... |`TimeLessOneHour(_time, time)` | ...
Also beware that you must pass in an epoch
time for OldTime
or it will not work because relative_time
requires epoch
.
Hi,
Thanks for your reply. My purpose of setting the macros is to print out the date_time variable to identify the source, which is a filename, named in YYYYMMDDHH. I'm trying to achieve here is to search index=set source='ytd1hourago' where the ytd11hourago is the macro name for printing out the date which is ytd 1 hour ago. It could be "index-set source=20150810. May I know how can I achieve that through macros?
Thank you.
Leon
OK, then my answer stands, except that (if I undersand you correctly), you would use it like this:
index=set [| noop | stats count | `TimeLessOneHour(now(), source)` | fields source]
This will normalize down to a search string that says this (but the date will obviously be different):
index=set source=20150810