datetrunc()

Truncates a date-time value to the specified time unit.

Syntax

datetrunc(DATE, INT{y|mon|w|d|h|m|s})
Required Parameter
DATE
Expression that returns a date type value. If it receives a value of a different type, it returns null.
INT
Time in units of y (year), mon (month), w (week), d (day), h (hour), m (minute), and s (second).

Usage

json "{}" 
| eval date=datetrunc(
  date("2014-07-14 11:13:23", "yyyy-MM-dd HH:mm:ss"),"1m"
)
  => 2014-07-14 11:13:00+0900

json "{}" 
| eval date=datetrunc(
  date("2014-07-14 11:13:23", "yyyy-MM-dd HH:mm:ss"),"5m"
)
  => 2014-07-14 11:10:00+0900

json "{}" 
| eval date=datetrunc(
  date("2014-07-14 11:13:23", "yyyy-MM-dd HH:mm:ss"),"1mon"
)
  => 2014-07-01 00:00:00+0900