truncate_time

datetime

Truncates a timestamp to the start of the specified time unit

Syntax

truncate_time(time, unit)

time (timestamp)

The timestamp to truncate

unit (string)

The unit to truncate to ("hour", "minute")

timestamp

The timestamp truncated to the start of the specified unit

Truncate to start of hour

Input:

truncate_time("2024-01-15 14:35:42", "hour")

Output:

"2024-01-15 14:00:00"

Truncate to start of minute

Input:

truncate_time("2024-01-15 14:35:42", "minute")

Output:

"2024-01-15 14:35:00"

Group by hour

Input:

.timestamp | truncate_time("hour")

Output:

Round down to hour

The truncate_time() function truncates a timestamp to the beginning of the specified time unit (hour or minute), removing smaller time components.

Use truncate_time() to group events by hour or minute, round down timestamps, or normalize time values for aggregation and analysis.