Please help me write a macro for the following eval search command

[smruti13]

eval range=case( start_time=="ZERO_TIME","All Time",
start_time!="ZERO_TIME" AND ctime - strptime(start_time, "%a %b %d %H:%M:%S %Y") <= 300, "5 Minutes",
start_time!="ZERO_TIME" AND ctime - strptime(start_time, "%a %b %d %H:%M:%S %Y") <= 900
AND ctime - strptime(start_time, "%a %b %d %H:%M:%S %Y") > 300, "15 Minutes",
start_time!="ZERO_TIME" AND ctime - strptime(start_time, "%a %b %d %H:%M:%S %Y") <= 3600
AND ctime - strptime(start_time, "%a %b %d %H:%M:%S %Y") > 900, "1 Hour", start_time!="ZERO_TIME"
AND ctime - strptime(start_time, "%a %b %d %H:%M:%S %Y") <= 14400 AND ctime
- strptime(start_time, "%a %b %d %H:%M:%S %Y") > 3600, "4 Hours",
start_time!="ZERO_TIME"
AND ctime - strptime(start_time, "%a %b %d %H:%M:%S %Y") <= 86400
AND ctime - strptime(start_time, "%a %b %d %H:%M:%S %Y") > 14400, "1 Day", start_time!="ZERO_TIME"
AND ctime - strptime(start_time, "%a %b %d %H:%M:%S %Y") <= 3888000
AND ctime - strptime(start_time, "%a %b %d %H:%M:%S %Y") > 86400, "1-45 Days", start_time!="ZERO_TIME"
AND ctime - strptime(start_time, "%a %b %d %H:%M:%S %Y") > 3888000, "45 Days +", start_time==start_time, "Other")

[DalJeanis]

If you are using CASE, then you never need to test for the opposite of a prior test. For example, with the first test being $start_time$=="ZERO_TIME", you don't need to ever test for$start_time$!="ZERO_TIME" in all the rest after that. Also, for each "less than x", you never have to test to make sure it's greater than that. So, for the first version of the code, the code simplifies to a much more readable version that looks something like this -

[crange(1)]
 args = start_time

 eval duration=IF( $start_time$=="ZERO_TIME",-1, now() - strptime($start_time$, "%a %b %d %H:%M:%S %Y"))
|
 eval range=case(duration < 0,"All Time", 
duration = 0,"Instant", 
duration <= 300, "5 Minutes", 
duration <= 900, "15 Minutes", 
duration <= 3600, "1 Hour", 
duration <= 14400,"4 Hours", 
duration <= 86400, "1 Day",
duration <= 3888000, "1-45 Days",
duration  > 3888000, "45 Days +"  )

[sundareshr · Accepted solution]

Assuming ctime is current time, try this. Once you've created the macro, use it like this crange(start_time)

[crange(1)]
args = start_time
eval range=case( $start_time$=="ZERO_TIME","All Time", 
$start_time$!="ZERO_TIME" AND now() - strptime($start_time$, "%a %b %d %H:%M:%S %Y") <= 300, "5 Minutes", 
$start_time$!="ZERO_TIME" AND now() - strptime($start_time$, "%a %b %d %H:%M:%S %Y") <= 900 
AND now() - strptime($start_time$, "%a %b %d %H:%M:%S %Y") > 300, "15 Minutes", 
$start_time$!="ZERO_TIME" AND now() - strptime($start_time$, "%a %b %d %H:%M:%S %Y") <= 3600 
AND now() - strptime($start_time$, "%a %b %d %H:%M:%S %Y") > 900, "1 Hour", $start_time$!="ZERO_TIME" 
AND now() - strptime($start_time$, "%a %b %d %H:%M:%S %Y") <= 14400 AND now() 
- strptime($start_time$, "%a %b %d %H:%M:%S %Y") > 3600, "4 Hours", 
$start_time$!="ZERO_TIME" 
AND now() - strptime($start_time$, "%a %b %d %H:%M:%S %Y") <= 86400 
AND now() - strptime($start_time$, "%a %b %d %H:%M:%S %Y") > 14400, "1 Day", $start_time$!="ZERO_TIME" 
AND now() - strptime($start_time$, "%a %b %d %H:%M:%S %Y") <= 3888000 
AND now() - strptime($start_time$, "%a %b %d %H:%M:%S %Y") > 86400, "1-45 Days", $start_time$!="ZERO_TIME" 
AND now() - strptime($start_time$, "%a %b %d %H:%M:%S %Y") > 3888000, "45 Days +", $start_time$==$start_time$, "Other")

*OR* if ctime is something else, try this and use it like this crange(start_time, ctime)

[crange(2)]
args = start_time, ctime

eval range=case( $start_time$=="ZERO_TIME","All Time", 
$start_time$!="ZERO_TIME" AND $ctime$ - strptime($start_time$, "%a %b %d %H:%M:%S %Y") <= 300, "5 Minutes", 
$start_time$!="ZERO_TIME" AND $ctime$ - strptime($start_time$, "%a %b %d %H:%M:%S %Y") <= 900 
AND $ctime$ - strptime($start_time$, "%a %b %d %H:%M:%S %Y") > 300, "15 Minutes", 
$start_time$!="ZERO_TIME" AND $ctime$ - strptime($start_time$, "%a %b %d %H:%M:%S %Y") <= 3600 
AND $ctime$ - strptime($start_time$, "%a %b %d %H:%M:%S %Y") > 900, "1 Hour", $start_time$!="ZERO_TIME" 
AND $ctime$ - strptime($start_time$, "%a %b %d %H:%M:%S %Y") <= 14400 AND $ctime$ 
- strptime($start_time$, "%a %b %d %H:%M:%S %Y") > 3600, "4 Hours", 
$start_time$!="ZERO_TIME" 
AND $ctime$ - strptime($start_time$, "%a %b %d %H:%M:%S %Y") <= 86400 
AND $ctime$ - strptime($start_time$, "%a %b %d %H:%M:%S %Y") > 14400, "1 Day", $start_time$!="ZERO_TIME" 
AND $ctime$ - strptime($start_time$, "%a %b %d %H:%M:%S %Y") <= 3888000 
AND $ctime$ - strptime($start_time$, "%a %b %d %H:%M:%S %Y") > 86400, "1-45 Days", $start_time$!="ZERO_TIME" 
AND $ctime$ - strptime($start_time$, "%a %b %d %H:%M:%S %Y") > 3888000, "45 Days +", $start_time$==$start_time$, "Other")

Here's how you can test it, after the macro is created. Change the value for x

| makeresults | eval x=45 | eval start_time=strftime(now()-x*2, "%a %b %d %H:%M:%S %Y") | eval ctime=now() | eval y=ctime - strptime(start_time, "%a %b %d %H:%M:%S %Y") | `crange(start_time, ctime)` | table x range ctime y start_time

[smruti13]

Thanks sundaresh. It works 🙂

[richgalloway]

What have you tried so far?