CQL duration() and datetime()

The duration() function in CQL uses ISO-8601 format to specify time periods:

• P prefix: Used for periods (days, months, years)
• PT prefix: Used for time-based durations (hours, minutes, seconds)

Common Duration Examples:

• P5D - 5 days
• P30D - 30 days
• P90D - 90 days
• PT30M - 30 minutes

To check if a custom metadata date falls within a specific time period (such as the last 90 days), use the following syntax:

datetime(custom("metadata-key")).fromNow() > duration("P-90D")

This expression compares the time elapsed since the metadata date to a duration of 90 days. The negative sign in P-90D indicates looking back in time.

To specify duration in minutes for a CQL custom event query, use the PT prefix followed by the number of minutes and the M suffix:

duration('PT30M')

This example represents a duration of 30 minutes. The PT prefix is essential when working with time-based units like minutes.

To filter alerts based on when they were detected, you can use the datetime() and duration() functions together. Here's an example that filters alerts detected within the last 5 days:

custom('mend').alerts.any(alert => datetime(alert.alertDetected).fromNow() < duration('P5D'))

This query checks if any alerts in the 'mend' custom field were detected within the past 5 days. You can adjust the duration parameter (e.g., P30D for 30 days) based on your requirements.