透過集合功能整理內容
你可以依據偏好儲存及分類內容。
timestamp.get_hour
timestamp.get_hour(unix_seconds [, time_zone])
說明
這個函式會傳回 [0, 23] 範圍內的整數，代表小時。
unix_seconds 是代表 Unix 紀元後經過秒數的整數，例如 $e.metadata.event_timestamp.seconds，或是包含該值的預留位置。time_zone 為選用項目，代表時區的字串。如果省略，預設值為「GMT」。您可以使用字串常值指定時區。選項包括：
- 時區資料庫名稱，例如「America/Los_Angeles」。詳情請參閱這個頁面的「時區資料庫名稱」欄。
- 與世界標準時間的時區偏移量，格式為
(+|-)H[H][:M[M]]，例如「-08:00」。
以下是有效的 time_zone 規範符示例，您可以將這些規範符做為第二個引數傳遞至時間擷取函式：
"America/Los_Angeles", or "-08:00". ("PST" is not supported)
"America/New_York", or "-05:00". ("EST" is not supported)
"Europe/London"
"UTC"
"GMT"
參數資料類型
INT、STRING
傳回類型
INT
程式碼範例
範例 1
在本範例中，我們省略了 time_zone 引數，因此預設為「GMT」。
$ts = $e.metadata.collected_timestamp.seconds
timestamp.get_hour($ts) = 15
範例 2
這個範例使用字串常值定義 time_zone。
$ts = $e.metadata.collected_timestamp.seconds
timestamp.get_hour($ts, "America/Los_Angeles") = 15
除非另有註明，否則本頁面中的內容是採用創用 CC 姓名標示 4.0 授權，程式碼範例則為阿帕契 2.0 授權。詳情請參閱《Google Developers 網站政策》。Java 是 Oracle 和/或其關聯企業的註冊商標。
上次更新時間：2025-07-29 (世界標準時間)。
[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-07-29 (世界標準時間)。"],[[["\u003cp\u003eThe \u003ccode\u003etimestamp.get_hour\u003c/code\u003e function extracts the hour (0-23) from a Unix timestamp, which is supported in both Rules and Search within the Chronicle documentation.\u003c/p\u003e\n"],["\u003cp\u003eThis function requires a Unix timestamp as input (\u003ccode\u003eunix_seconds\u003c/code\u003e), representing seconds since the Unix epoch, often derived from event metadata like \u003ccode\u003e$e.metadata.event_timestamp.seconds\u003c/code\u003e.\u003c/p\u003e\n"],["\u003cp\u003eAn optional \u003ccode\u003etime_zone\u003c/code\u003e string argument can be included to specify a time zone using either the TZ database name (e.g., "America/Los_Angeles") or a UTC offset (e.g., "-08:00").\u003c/p\u003e\n"],["\u003cp\u003eIf the \u003ccode\u003etime_zone\u003c/code\u003e argument is omitted, the function defaults to using "GMT" for time zone calculations.\u003c/p\u003e\n"],["\u003cp\u003eThe return type for the function will be an Integer.\u003c/p\u003e\n"]]],[],null,["### timestamp.get_hour\n\nSupported in: \n[Rules](/chronicle/docs/detection/default-rules) [Search](/chronicle/docs/investigation/udm-search) \n\n timestamp.get_hour(unix_seconds [, time_zone])\n\n#### Description\n\nThis function returns an integer in the range `[0, 23]` representing the hour.\n\n- `unix_seconds` is an integer representing the number of seconds past Unix epoch, such as `$e.metadata.event_timestamp.seconds`, or a placeholder containing that value.\n- `time_zone` is optional and is a string representing a time zone. If omitted, the default is \"GMT\". You can specify time zones using string literals. The options are:\n - The TZ database name, for example \"America/Los_Angeles\". For more information, see the [\"TZ Database Name\" column from this page](https://en.wikipedia.org/wiki/List_of_tz_database_time_zones)\n - The time zone offset from UTC, in the format`(+|-)H[H][:M[M]]`, for example: \"-08:00\".\n\nHere are examples of valid `time_zone` specifiers, which you can pass as the second argument to time extraction functions: \n\n \"America/Los_Angeles\", or \"-08:00\". (\"PST\" is not supported)\n \"America/New_York\", or \"-05:00\". (\"EST\" is not supported)\n \"Europe/London\"\n \"UTC\"\n \"GMT\"\n\n#### Param data types\n\n`INT`, `STRING`\n\n#### Return type\n\n`INT`\n\n#### Code samples\n\n##### Example 1\n\nIn this example, the `time_zone` argument is omitted, so it defaults to \"GMT\". \n\n $ts = $e.metadata.collected_timestamp.seconds\n\n timestamp.get_hour($ts) = 15\n\n##### Example 2\n\nThis example uses a string literal to define the `time_zone`. \n\n $ts = $e.metadata.collected_timestamp.seconds\n\n timestamp.get_hour($ts, \"America/Los_Angeles\") = 15"]]
