LIVEcommunity - Who rated this post

You can sort out the parse_timestamp with this line:

alter install_date_mod = parse_timestamp("\"%Y-%m-%d\"", install_date

Note the use of regex to escape the double-quotes that comes as part of the default install_date string.

So the whole query would look like

dataset = host_inventory
| arrayexpand kbs
| alter kbnr = json_extract(kbs , "$.name"), install_date = json_extract(kbs , "$.installation_date")
| fields host_name, kbnr , install_date
| alter install_date = parse_timestamp("\"%Y-%m-%d\"", install_date)
| dedup host_name by desc install_date
| sort asc install_date

View solution in original post

Who rated this post

L4 Transporter

Rating date:

Unlock your full community experience!

Who rated this post