Hi,
I have time format as:
2019-10-08 15:24:40.132 UTC
I used eval to strip it to:
2019-10-08 15:24:40
I need to calculate Age. My eval is below but it is not working. Can someone assist pls?
| eval age=ceiling((now()-strptime(Event_Created_Time_Date,"%F %H:%M:%S"))/86400)
| eval Event_Age=case(
age<1,"1_Less than 1 Days",
age>=30,"6_Older than 30 Days",
age>=20,"5_Older than 20 Days",
age>=10,"4_Older than 10 Days",
age>=5,"3_Older than 5 Days",
age>=2,"2_Older than 2 Days",
0==0,"7_No Age Data")
hi @mbasharat, For timezone (UTC) you can set variable "%Z".
Try this:
| makeresults
| eval Event_Created_Time_Date="2019-10-08 15:24:40.132 UTC"
| eval age=ceiling((now() - strptime(Event_Created_Time_Date, "%Y-%m-%d %H:%M:%S.%3N %Z"))/86400)
| eval Event_Age=case(
age<1,"1_Less than 1 Days",
age>=30,"6_Older than 30 Days",
age>=20,"5_Older than 20 Days",
age>=10,"4_Older than 10 Days",
age>=5,"3_Older than 5 Days",
age>=2,"2_Older than 2 Days",
0==0,"7_No Age Data")
hi @mbasharat, For timezone (UTC) you can set variable "%Z".
Try this:
| makeresults
| eval Event_Created_Time_Date="2019-10-08 15:24:40.132 UTC"
| eval age=ceiling((now() - strptime(Event_Created_Time_Date, "%Y-%m-%d %H:%M:%S.%3N %Z"))/86400)
| eval Event_Age=case(
age<1,"1_Less than 1 Days",
age>=30,"6_Older than 30 Days",
age>=20,"5_Older than 20 Days",
age>=10,"4_Older than 10 Days",
age>=5,"3_Older than 5 Days",
age>=2,"2_Older than 2 Days",
0==0,"7_No Age Data")
THANK YOU!!!