XQL - Time alteration

[AvesterFahimipour]

Hello,

Here is the scenario:

I have a table lookup looking for a specific event.

dataset = xdr_data

| filter event_type = SOME EVENT   

| alter TimeOfIntereset = _time

Now I want to join this again with the dataset table to enrich it and perform further analysis based on the time.

| join type = inner (

dataset = xdr_data

| filter event_type = SOME EVENT )

At this part when the join happens I only want to look at 30 seconds to 1 minute of events after the time the event of interest occurred.

| filter _time > TimeOfIntereset and  _time < TimeOfIntereset + 30s

The issue is that you cannot just add time to a time field.
Personally I believe that XQL is super rigid.

The scenario is essentially a sequence event where I want to look for events occurring up to a minute after a specific event.

so The question is how can I alter the field to be able to add 30 seconds or 1 minute to it and then use it for the filter.

[AvesterFahimipour · Accepted solution]

Hello Again,
I was able to find the solution:
| alter EndTime = to_timestamp(add(to_epoch(ClipTime , "SECONDS") , 30))
This is how you do it.