Date and Time Functions for Where Clauses

In order to resolve date-time values at process/execution time as opposed to parse time (e.g. constant timestamp), the following date-time parameters are available.

  • CurrentTime:
    This parameter is resolved at the server current time while executing the Where Clause.

    Example:
    EVENT.TIME > CurrentTime - 00:05:00
    This returns the events that occurred in the last 5 minutes.

  • StartOfYear, StartOfMonth, StartOfWeek, StartOfDay, StartOfHour:
    These parameters support the relative calendar date for calculations and comparisons.

    Examples:

    NTFILE.MODIFYTS > StartOfWeek

    This will list all files that have been modified since the start of this week (Monday of the current week at 00:00am).  The date-time is resolved once the Where Clause is executed on the server, applying the server’s local time.  Note that this Where Clause is different from the following example.

    NTFILE.MODIFYTS > CurrentTime - 00000007-00:00:00

    This lists all files that have been modified in the last 7 days.

    LOGTIME > StartOfWeek + 5 DAYS

    Check for transactions that occurred on a weekend.

Provide feedback on this article