These docs are for Cribl Stream 4.11 and are no longer actively maintained.

See the latest version (4.13).

C.Time – Time Methods

C.Time.adjustTZ()

​

C.Time.adjustTZ(epochTime: number, tzTo: string, tzFrom: string = 'UTC'): number | undefined

Adjusts a timestamp from one timezone to another.

Returns the adjusted timestamp, in UNIX epoch time (ms).

Cribl relies on this list of TZ Database Time Zones.

Note that these are timezone identifiers (full names), not abbreviations such as “CET”, “PST”, “EST”, and so on.

Examples

​

To adjust a timestamp found in the _time field to a selected timezone (here, Australia/Melbourne), use:

C.Time.adjustTZ(_time, "Australia/Melbourne")

The method returns the timestamp in milliseconds. If you want to further operate on it using methods such as strftime(), which takes as parameter UNIX epoch time in seconds, you can divide it by 1000:

C.Time.strftime(C.Time.adjustTZ(_time, "Australia/Melbourne") / 1000, "%d %B %Y %H %M %Z" )

C.Time.clamp()

​

C.Time.clamp(date: T, earliest: T, latest: T, defaultDate?: T ): T  | undefined

Constrains a parsed timestamp to realistic earliest and latest boundaries.

Returns a JavaScript Date object or timestamp, depending on the format of the date parameter.

Examples

​

Suppose you have a date in a "YYYY-MM-DD" format in a time field. To make sure this date does not exceed the range of 1 Jan 2020 – 1 Jan 2025, you can use:

C.Time.clamp(time, "2020-01-01", "2025-01-01")

To make sure that all dates that fall outside the bounds are changed to a specific value, add the third parameter:

C.Time.clamp(time, "2020-01-01", "2025-01-01", "2022-02-22")

C.Time.strftime()

​

C.Time.strftime(date: number | Date | string, format: string, utc: boolean = true): string | undefined

Formats a Date object or timestamp number as a time string, using d3js time format.

Returns representation of the given date in the specified format.

Examples

​

To transform a _time field containing a UNIX timestamp to a string with time formatted, for example: 15 November 2023, 08:03, you can use:

C.Time.strftime(_time, "%d %B %Y, %H:%M")

Some common formats (assuming UNIX timestamp of 1702460134) are:

For detailed reference of the date and time tokens, see d3js reference or Auto Timestamp.

C.Time.strptime()

​

C.Time.strptime(str: string, format: string, utc: boolean = true, strict: boolean = false): Date

Extracts time from a string using d3js time format that defines the format of the incoming string.

Returns a parsed JavaScript Date object, or null if the specified format did not match.

Examples

​

To convert a string in the "YYYY-MM-DD" format, for example "2023-12-12", to a Date object, use:

C.Time.strptime(F, "%Y-%m-%d")

Additionally, to interpret the time in UTC, and make sure null is returned if the timestamp contains any trailing characters, use:

C.Time.strptime(F, "%Y-%m-%d", true, true)

For detailed reference of the date and time tokens, see d3js reference or Auto Timestamp.

C.Time.timestampFinder()

​

C.Time.timestampFinder(utc?: boolean).find(str: string): IAutoTimeParser

Extracts time from the specified field, using the same algorithm as the Auto Timestamp Function and Event Breakers.

Returns representation of the extracted time; truncates timestamps to three-digit (milliseconds) resolution, omitting trailing zeros.

Examples

​

To find timestamps in the _raw field and output them in UTC, you can use:

C.Time.timestampFinder(true).find(_raw)

You can then format the string output with strftime():

C.Time.strftime(C.Time.timestampFinder(true).find(_raw), "%d.%m.%Y, %H.%M")

C.Time.timePartition()

​

C.Time.timePartition(date: number | Date | string, level: 'd' | 'h'): string | undefined

Provides the part of the file path prefix that contains the date.

Returns a string in the format YYYY/MM/DD for d and YYYY/MM/DD/HH for h.

Examples

​

To get the file path prefix from the _time field:

C.Time.timePartition(_time)

This will return the prefix in the form of, for example: 2024/04/23.

C.Time.s3TimePartition()

​

C.Time.s3TimePartition(date: number | Date | string, level: 'd' | 'h'): string | undefined

Provides the full S3 file path prefix for a given datetime.

Returns the file path prefix as a string.

Examples

​

To get the S3 file path prefix from the _time field:

C.Time.s3TimePartition(_time)

This will return the prefix in the form of, for example: hjhg-2024/aj-04/ai-23.