How to use XQL parse_timestamp

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

How to use XQL parse_timestamp

L0 Member

I am trying to convert a string to a timestamp object and cannot understand how the parse_timestamp function works.

My string is as follow : 

"2023-08-17T17:40:38.000246+0300"
 
My XQL query is as follow :
alter
timestamp = parse_timestamp("%Y-%m-%dT%H:%M:%S", format_string("%s", <field containing the timestamp string>))
 
This is clearly not the right way to use this function, but I cannot find any clear example showing how the function works...
Does anybody have a working example and can show their input and output ?
 
The documentation is not helpful
2 REPLIES 2

L4 Transporter

Hello @unlucky ,

 

Thanks for reaching out on LiveCommunity!

I think the function you are looking for is format_timestamp in place of format_string because your data is already in timestamp format.

Lets understand the definition of these 3 functions.

parse_timestamp() -> The parse_timestamp() function returns a TIMESTAMP object after converting a string representation of a timestamp.

format_timestamp() -> The format_timestamp() function returns a string after formatting a timestamp according to a specified string format.

format_string() -> The format_string() function returns a string from a format string that contains zero or more format specifiers, along with a variable length list of additional arguments that matches the format specifiers. 

Since the string you are trying to convert is already a timestamp hence please use format_timestamp function which will take a timestamp and return a string to parse_timestamp function to convert it to a timestamp of your choice. I have tried below line and its working for me.

alter time_test = parse_timestamp("%Y/%m/%d %H:%M:%S", format_timestamp("%Y/%m/%d %H:%M:%S", _time))

 

Below are the reference link for above functions.

https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-XQL-Language-Reference/parse_timest...

https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-XQL-Language-Reference/format_times...

https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-XQL-Language-Reference/format_strin...

 

 

ErrorField timestamp for function format_timestamp is invalid. Expected date but received string.

 

As I was saying, even though my string contains a timestamp, it is still a string!

Maybe there is something I am not understanding here, but what I am trying to achieve is to convert this string to a date type.

  • 1490 Views
  • 2 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!