Improvements for formatTime

[deejgregor]

• Humio Version: 1.0.61--build-2063--sha-032ef3017
• Browser Version: Chrome Version 67.0.3396.87 (Official Build) (64-bit)
• API
• Query Examples: (partial example): ... stuff ... | groupby([customer, uid], function=[avg(pct_drop, as=pct_drop), max(@timestamp, as=timestamp)]) | sort(pct_drop) | formatTime("%Y-%m-%d %H:%M:%S GMT", field=timestamp, as=most_recent, timezone=Z) | table([customer, uid, pct_drop, most_recent])

I would like to instead use something like this for my formatTime() call above: formatTime( field=timestamp, as=most_recent). So, I have these three specific requests for formatTime():

1. Can the timezone be made to default to "the local time zone" (however you chose it for the rest of the UI)?
2. If item 1 can't happen (or even if it can), can I specify a value for the timezone parameter that means "the local time zone" (however you chose it for the rest of the UI)?
3. Can the format be made optional and default to a common format, possibly the same one that used for browsing events (also see item 1, where I suggest using the local time zone, which is the same thing that is used for the timestamp in the events view)?

One last thing: your example for formatTime is wrong: "as" is a required field, however your example doesn't include it and instead uses an eval-style ":=" assignment from a function return value.

Lastly, there might be a broader, better way to accomplish what I'm doing above. I'm trying to get the timestamp in a user-friendly format of the last event for each groupby collection. I have to hack it using max() and then formatTime (and later table to ignore the extra column I don't want to show) because the value returned is an integer and not a user-friendly timestamp.

[pmech]

Hi.

What you suggest makes good sense. I'm not sure when this will fit into our pipeline, but if it is easy we might be able to squeeze it in :).

Thanks for the suggestions and sorry for the long response time.