DateTime Functions
A list of all DateTime functions supported by Cribl Search.
| Name | Description |
|---|---|
ago | Subtracts the given timespan from the current UTC clock time. |
datetime_add | Calculates a new datetime from a specified datepart multiplied by a specified amount, added to a specified datetime. |
datetime_diff | Calculates the number of the specified periods between two datetime values. |
datetime_part | Extracts the requested date part as an integer value. |
dayofmonth | Returns the integer number representing the day number of the given month. |
dayofweek | Returns an integer between 0 and 6 representing the day of the week, beginning on Sunday. |
dayofyear | Returns the integer number representing the day number of the given year. |
endofday | Returns the end of the day containing the date, shifted by an offset, if provided. |
endofmonth | Returns the end of the month containing the date, shifted by an offset, if provided. |
endofweek | Returns the end of the week containing the date, shifted by an offset, if provided. |
endofyear | Returns the end of the year containing the date, shifted by an offset, if provided. |
format_datetime | Formats a datetime according to the provided format. |
format_timespan | Formats a timespan according to the provided format. |
getmonth (monthofyear) | Gets the month number (1–12) from a datetime. |
getyear (yearofyear) | Returns the year part of a datetime. |
hourofday | Returns the integer number representing the hour number of the given date. |
make_datetime | Converts the specified date and time into a datetime value (Unix time in seconds). |
make_timespan | Converts the specified time period into a datetime value (Unix time in seconds). |
now | Returns the current UTC clock time as a datetime value (Unix time in seconds). |
startofday | Returns the start of the day containing the date, shifted by an offset, if provided. |
startofmonth | Returns the start of the month containing the date, shifted by an offset, if provided. |
startofweek | Returns the start of the week containing the date, shifted by an offset, if provided. |
startofyear | Returns the start of the year containing the date, shifted by an offset, if provided. |
strftime (format_time) | Converts a datetime (date) object to a human-readable string. |
strptime (parse_time) | Converts a string to a datetime. |
todatetime | Converts the input into a datetime value (Unix time in seconds). |
totimespan | Converts the input into a number of seconds. |
unixtime_microseconds_todatetime | Converts the input into a datetime value (Unix time in seconds). |
unixtime_milliseconds_todatetime | Converts the input into a datetime value (Unix time in seconds). |
unixtime-nanoseconds_todatetime | Converts the input into a datetime value (Unix time in seconds). |
unixtime_seconds_todatetime | Converts the input into a datetime value (Unix time in seconds). |
week_of_year | Returns an integer representing the week number. |