Derived Column Time Functions

Time functions calculate and manipulate time data.

UNIX_TIMESTAMP 

Converts a date string in RFC3339 format (for example, 2017-07-20T11:22:44.888Z) to a Unix timestamp (1500549764.888). This is useful for comparing two timestamps in an event; for example, to calculate a duration from a start and an end timestamp.

# Usage: UNIX_TIMESTAMP(string)
# Examples
UNIX_TIMESTAMP($timestamp)

EVENT_TIMESTAMP 

Returns the Unix timestamp, also known as the Epoch timestamp, of the current event as a float (1500549764.888, for example). This is useful for comparing two timestamps in an event; for example, to calculate a duration from a start and an end timestamp. This function takes no arguments.

# Usage: EVENT_TIMESTAMP()
# Examples
EVENT_TIMESTAMP()

INGEST_TIMESTAMP 

Returns the Unix timestamp, also known as the Epoch timestamp, indicating when Honeycomb’s servers received the current event, as a float (1500549764.888, for example). This is useful for debugging event latency by comparing the event timestamp to the ingestion time. This function takes no arguments.

# Usage: INGEST_TIMESTAMP()
# Examples
# Event latency, in seconds. May be negative for future-dated events.
SUB(INGEST_TIMESTAMP(),EVENT_TIMESTAMP())
# Event latency, in minutes. May be negative for future-dated events.
DIV(SUB(INGEST_TIMESTAMP(),EVENT_TIMESTAMP()),60)
# Event latency, accounting for span duration. Assumes `duration_ms` is in milliseconds.
SUB(INGEST_TIMESTAMP(),SUM(EVENT_TIMESTAMP(),DIV($duration_ms,1000)))

FORMAT_TIME 

Formats a Unix timestamp, also known as an Epoch timestamp, as a string. The first argument is a format specifier string compatible with POSIX strftime, and the second argument is the numeric timestamp. Does not support not-UTC timezones or locale-modified specifiers. Also note this formatting is more expensive than other derived column functions and may slow down queries, especially when using a complex format.

# Usage: FORMAT_TIME(format, timestamp)
# Examples
FORMAT_TIME("%A", 1626810584)     # Tuesday
FORMAT_TIME("%FT%TZ", 1626810584) # 2021-07-20T19:49:44Z