I have a form that takes 2 timestamps in UTC. I need to convert them to local time and then add or subtract an hour. So far I've tried:
host="juniper" port="$port$" src_translated_ip="$ip$"
timeformat="%Y-%m-%dT%H:%M:%S.%3N%"
earliest="$first$"
latest="$last$"
This correctly converts the UTC to local time, but I can't figure out how to add or subtract an hour to "$first$" and "$last$" before passing them to earliest and also making sure they get converted.
This was my attempt, but the timestamps are way off:
host="juniper" port="$port$" src_translated_ip="$ip$" timeformat="%Y-%m-%dT%H:%M:%S.%3N%Z" |
eval earliest=relative_time("$first$", "-1h") |
eval latest=relative_time("$last$", "+1h")
Turns out it wasn't so complicated:
ost="juniper" port="$port$" src_translated_ip="$ip$" timeformat="%Y-%m-%dT%H:%M:%S.%3N%Z" earliest="$first$-2h" latest="$last$+2h"
Turns out it wasn't so complicated:
ost="juniper" port="$port$" src_translated_ip="$ip$" timeformat="%Y-%m-%dT%H:%M:%S.%3N%Z" earliest="$first$-2h" latest="$last$+2h"