I would like to instead use something like this for my formatTime() call above: formatTime( field=timestamp, as=most_recent). So, I have these three specific requests for formatTime():
Can the timezone be made to default to "the local time zone" (however you chose it for the rest of the UI)?
If item 1 can't happen (or even if it can), can I specify a value for the timezone parameter that means "the local time zone" (however you chose it for the rest of the UI)?
Can the format be made optional and default to a common format, possibly the same one that used for browsing events (also see item 1, where I suggest using the local time zone, which is the same thing that is used for the timestamp in the events view)?
One last thing: your example for formatTime is wrong: "as" is a required field, however your example doesn't include it and instead uses an eval-style ":=" assignment from a function return value.
Lastly, there might be a broader, better way to accomplish what I'm doing above. I'm trying to get the timestamp in a user-friendly format of the last event for each groupby collection. I have to hack it using max() and then formatTime (and later table to ignore the extra column I don't want to show) because the value returned is an integer and not a user-friendly timestamp.
... stuff ... | groupby([customer, uid], function=[avg(pct_drop, as=pct_drop), max(@timestamp, as=timestamp)]) | sort(pct_drop) | formatTime("%Y-%m-%d %H:%M:%S GMT", field=timestamp, as=most_recent, timezone=Z) | table([customer, uid, pct_drop, most_recent])
I would like to instead use something like this for my formatTime() call above: formatTime( field=timestamp, as=most_recent). So, I have these three specific requests for formatTime():
One last thing: your example for formatTime is wrong: "as" is a required field, however your example doesn't include it and instead uses an eval-style ":=" assignment from a function return value.
Lastly, there might be a broader, better way to accomplish what I'm doing above. I'm trying to get the timestamp in a user-friendly format of the last event for each groupby collection. I have to hack it using max() and then formatTime (and later table to ignore the extra column I don't want to show) because the value returned is an integer and not a user-friendly timestamp.