datetrunc()
Truncates a date-time value to the specified time unit.
Syntax
datetrunc(DATE, INT{y|mon|w|d|h|m|s})
Required Parameter
DATE
- Expression that returns a date type value. If it receives a value of a different type, it returns
null
. INT
- Time in units of
y
(year),mon
(month),w
(week),d
(day),h
(hour),m
(minute), ands
(second).
Usage
json "{}"
| eval date=datetrunc(
date("2014-07-14 11:13:23", "yyyy-MM-dd HH:mm:ss"),"1m"
)
=> 2014-07-14 11:13:00+0900
json "{}"
| eval date=datetrunc(
date("2014-07-14 11:13:23", "yyyy-MM-dd HH:mm:ss"),"5m"
)
=> 2014-07-14 11:10:00+0900
json "{}"
| eval date=datetrunc(
date("2014-07-14 11:13:23", "yyyy-MM-dd HH:mm:ss"),"1mon"
)
=> 2014-07-01 00:00:00+0900