使用集合让一切井井有条
根据您的偏好保存内容并对其进行分类。
timestamp.get_hour
timestamp.get_hour(unix_seconds [, time_zone])
说明
此函数会返回 [0, 23] 范围内的整数，表示小时。
unix_seconds 是一个表示经过 Unix 计时原点的秒数（例如 $e.metadata.event_timestamp.seconds）的整数，或一个包含该值的占位符。time_zone 是可选的，是表示时区的字符串。如果省略，则默认值为“GMT”。您可以使用字符串字面量来指定时区。选项包括：
- TZ 数据库名称，例如“America/Los_Angeles”。如需了解详情，请参阅本页中的“TZ 数据库名称”列
- 相对于世界协调时间 (UTC) 的时区偏离值，格式为
(+|-)H[H][:M[M]]，例如“-08:00”。
以下是有效 time_zone 说明符的示例，您可以将其作为第二个实参传递给时间提取函数：
"America/Los_Angeles", or "-08:00". ("PST" is not supported)
"America/New_York", or "-05:00". ("EST" is not supported)
"Europe/London"
"UTC"
"GMT"
形参数据类型
INT，STRING
返回类型
INT
代码示例
示例 1
在此示例中，省略了 time_zone 实参，因此默认值为“GMT”。
$ts = $e.metadata.collected_timestamp.seconds
timestamp.get_hour($ts) = 15
示例 2
以下示例使用字符串字面量来定义 time_zone。
$ts = $e.metadata.collected_timestamp.seconds
timestamp.get_hour($ts, "America/Los_Angeles") = 15
如未另行说明，那么本页面中的内容已根据知识共享署名 4.0 许可获得了许可，并且代码示例已根据 Apache 2.0 许可获得了许可。有关详情，请参阅 Google 开发者网站政策。Java 是 Oracle 和/或其关联公司的注册商标。
最后更新时间 (UTC)：2025-07-29。
[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-07-29。"],[[["\u003cp\u003eThe \u003ccode\u003etimestamp.get_hour\u003c/code\u003e function extracts the hour (0-23) from a Unix timestamp, which is supported in both Rules and Search within the Chronicle documentation.\u003c/p\u003e\n"],["\u003cp\u003eThis function requires a Unix timestamp as input (\u003ccode\u003eunix_seconds\u003c/code\u003e), representing seconds since the Unix epoch, often derived from event metadata like \u003ccode\u003e$e.metadata.event_timestamp.seconds\u003c/code\u003e.\u003c/p\u003e\n"],["\u003cp\u003eAn optional \u003ccode\u003etime_zone\u003c/code\u003e string argument can be included to specify a time zone using either the TZ database name (e.g., "America/Los_Angeles") or a UTC offset (e.g., "-08:00").\u003c/p\u003e\n"],["\u003cp\u003eIf the \u003ccode\u003etime_zone\u003c/code\u003e argument is omitted, the function defaults to using "GMT" for time zone calculations.\u003c/p\u003e\n"],["\u003cp\u003eThe return type for the function will be an Integer.\u003c/p\u003e\n"]]],[],null,["### timestamp.get_hour\n\nSupported in: \n[Rules](/chronicle/docs/detection/default-rules) [Search](/chronicle/docs/investigation/udm-search) \n\n timestamp.get_hour(unix_seconds [, time_zone])\n\n#### Description\n\nThis function returns an integer in the range `[0, 23]` representing the hour.\n\n- `unix_seconds` is an integer representing the number of seconds past Unix epoch, such as `$e.metadata.event_timestamp.seconds`, or a placeholder containing that value.\n- `time_zone` is optional and is a string representing a time zone. If omitted, the default is \"GMT\". You can specify time zones using string literals. The options are:\n - The TZ database name, for example \"America/Los_Angeles\". For more information, see the [\"TZ Database Name\" column from this page](https://en.wikipedia.org/wiki/List_of_tz_database_time_zones)\n - The time zone offset from UTC, in the format`(+|-)H[H][:M[M]]`, for example: \"-08:00\".\n\nHere are examples of valid `time_zone` specifiers, which you can pass as the second argument to time extraction functions: \n\n \"America/Los_Angeles\", or \"-08:00\". (\"PST\" is not supported)\n \"America/New_York\", or \"-05:00\". (\"EST\" is not supported)\n \"Europe/London\"\n \"UTC\"\n \"GMT\"\n\n#### Param data types\n\n`INT`, `STRING`\n\n#### Return type\n\n`INT`\n\n#### Code samples\n\n##### Example 1\n\nIn this example, the `time_zone` argument is omitted, so it defaults to \"GMT\". \n\n $ts = $e.metadata.collected_timestamp.seconds\n\n timestamp.get_hour($ts) = 15\n\n##### Example 2\n\nThis example uses a string literal to define the `time_zone`. \n\n $ts = $e.metadata.collected_timestamp.seconds\n\n timestamp.get_hour($ts, \"America/Los_Angeles\") = 15"]]
