time
Now
The now
subcommand returns the current date and time:
| eval now=now()
StrfTime
The strftime
subcommand formats a timestamp into a string. The format variables that can be used are listed here.
Example to get the current year:
| eval year=strftime(now(), "%Y")
StrpTime
The strptime
subcommand attempts to parse a string into a timestamp. The format variables that can be used are listed here.
The parsing format must include timezone information.
| eval
time=strptime("1970-01-01T00:00:00Z", "%+")
time2=strptime("1970-01-01T00:00:00+0000", "%Y-%m-%dT%H:%M:%S%z")