Time Functions in Calculated Fields

Time functions calculate and manipulate time data.

`UNIX_TIMESTAMP`

Converts a date string in RFC3339 format (for example, 2017-07-20T11:22:44.888Z) to a Unix timestamp (1500549764.888). This is useful for comparing two timestamps in an event; for example, to calculate a duration from a start and an end timestamp.

# Usage: UNIX_TIMESTAMP(string)
# Examples
UNIX_TIMESTAMP($timestamp)

`EVENT_TIMESTAMP`

Returns the Unix timestamp, also known as the Epoch timestamp, of the current event as a float (1500549764.888, for example). This is useful for comparing two timestamps in an event; for example, to calculate a duration from a start and an end timestamp. This function takes no arguments.

# Usage: EVENT_TIMESTAMP()
# Examples
EVENT_TIMESTAMP()

`INGEST_TIMESTAMP`

Returns the Unix timestamp, also known as the Epoch timestamp, indicating when Honeycomb’s servers received the current event, as a float (1500549764.888, for example). This is useful for debugging event latency by comparing the event timestamp to the ingestion time. This function takes no arguments.

# Usage: INGEST_TIMESTAMP()
# Examples
# Event latency, in seconds. May be negative for future-dated events.
SUB(INGEST_TIMESTAMP(),EVENT_TIMESTAMP())
# Event latency, in minutes. May be negative for future-dated events.
DIV(SUB(INGEST_TIMESTAMP(),EVENT_TIMESTAMP()),60)
# Event latency, accounting for span duration. Assumes `duration_ms` is in milliseconds.
SUB(INGEST_TIMESTAMP(),SUM(EVENT_TIMESTAMP(),DIV($duration_ms,1000)))

`FORMAT_TIME`

Formats a Unix timestamp, also known as an Epoch timestamp, as a string. The first argument is a format specifier string compatible with POSIX strftime, and the second argument is the numeric timestamp. Does not support not-UTC timezones or locale-modified specifiers. Also note this formatting is more expensive than other calculated field functions and may slow down queries, especially when using a complex format.

# Usage: FORMAT_TIME(format, timestamp)
# Examples
FORMAT_TIME("%A", 1626810584)     # Tuesday
FORMAT_TIME("%FT%TZ", 1626810584) # 2021-07-20T19:49:44Z

Getting Started

Reference

API Endpoints

Time Functions in Calculated Fields

`UNIX_TIMESTAMP`

`EVENT_TIMESTAMP`

`INGEST_TIMESTAMP`

`FORMAT_TIME`

​UNIX_TIMESTAMP

​EVENT_TIMESTAMP

​INGEST_TIMESTAMP

​FORMAT_TIME

`UNIX_TIMESTAMP`

`EVENT_TIMESTAMP`

`INGEST_TIMESTAMP`

`FORMAT_TIME`