How to get the difference between two date/times, and convert it to action XML scheduling format

Hi All,

I feel like this is something that should be possible using relevance, and I just wanted to put the feelers out to see what people thought.

What I want to do is this:

  1. Accept a date and time as a string, e.g. "Mon, 14 Dec 2015 12:00:00 +0000"
    (if we could somehow leave out the day name and just get away with just the date, time and TZ info then so much the better)

  2. Get the difference between this time and the current date and time as # of days, hours, mins and seconds

  3. Convert that result into a format that could be used as the scheduled start time in an action being imported using the REST API, e.g. "P1DT6H30M00S" (to start in 1 day, 6 hours and 30 minutes from now)

NOTE:
From the BES.xsd file, the format I need to confirm to is the TimeInterval type:

<xs:simpleType name="TimeInterval"> <xs:restriction base="xs:duration"> <xs:pattern value="\-?P([0-9]+D)?(T([0-9]+H)?([0-9]+M)?([0-9]+(\.[0-9]{1,6})?S)?)?" /> </xs:restriction> </xs:simpleType>

Hey Paul,

  1. You can cast the string as a time object using
    "Mon, 14 Dec 2015 12:00:00 +0000" as time. (This will also work if Mon is removed)

  2. You should be able to subtract times using the minus operator. In this case:
    "Mon, 14 Dec 2015 12:00:00 +0000" as time - now
    returns
    -1 day, 03:17:34
    You can use absolute value of <time interval> to always return the difference as a positive value, if needs be

  3. I don’t know of a direct way to convert this to a usable Time Interval. But, you could manipulate the returned value as a string through relevance to give the output desired

Hope this helps

1 Like

Hey many thanks Eoin - I think I’ve got it now.

(serious forehead slapping moment after I read your post above… in my tests before posting I must have only tried to cast the string to a date rather than a time object!)

So for anyone interested, here’s what the final expression looks like:

 ( "P" & item 0 of it & "T" & item 1 of it & "H" & item 2 of it & "M" & item 3 of it & "S" )
 of
 (
   if
     (
       it contains " day"
     )
   then
     (
       (
         parenthesized part 1 of it as string, 
         parenthesized part 2 of it as string, 
         parenthesized part 3 of it as string, 
         parenthesized part 4 of it as string
       )
       of matches 
       (
         regex "(\d+) days?\, (\d{2})\:(\d{2})\:(\d{2})"
       )
       of it
     )
   else
     (
       (
         "0", 
         parenthesized part 1 of it as string, 
         parenthesized part 2 of it as string, 
         parenthesized part 3 of it as string
       )
       of matches 
       (
         regex "(\d{2})\:(\d{2})\:(\d{2})"
       )
       of it
     )
 )
 of 
 (
   (
     "17 Dec 2015 19:00:00 +0000" as time - now
   )
   as string
 )

This returns me the result: "P2T02H46M54S"

Thanks again Eoin.

-Paul.

3 Likes

This should do the same, but without the use of RegEx:

("P" & (preceding text of first " day" of it | "0") & "DT" & ( preceding text of first ":" of (following text of first ", " of it | it)) & "H" & (preceding text of first ":" of following text of first ":" of it) & "M" & (following text of last ":" of it) & "S") of (it as string) of ("19 Dec 2015 19:00:00 +0000" as time - now)

Result:

Q: ("P" & (preceding text of first " day" of it | "0") & "DT" & ( preceding text of first ":" of (following text of first ", " of it | it)) & "H" & (preceding text of first ":" of following text of first ":" of it) & "M" & (following text of last ":" of it) & "S") of (it as string) of ("19 Dec 2015 19:00:00 +0000" as time - now)
A: P2DT13H07M12S
T: 0.265 ms
1 Like

Ah! Excellent! :smile:

I like RegEx, but I tend to use it sparingly. It isn’t as obvious what it does at a glance and it isn’t as deterministic in terms of how long it should take to process strings of different lengths and values.

RegEx is extremely powerful, and I’m glad to have it.

Also, I’m curious what you are doing with this relevance?

I’m using relevance and/or session relevance to build BigFix custom content XML for automation with the REST API. Seems like you might be doing something similar.

Yes, pretty much same thing here… we’ve had a request from a customer whereby they would like to specify an absolute
start date/time when creating actions using the REST API, and I just wanted to check to see if it was possible to take the calculation off their plates and put it onto a relevance call. Thankfully, looks like we can do that :smile:

In a bunch of the REST API automation I am doing, it is only using relevance and cURL. So I am using relevance to build relevance and actionscript and XML. Basically not using any real programming language at all.


See these examples:

That’s a really clever technique… I think some of the content is being lost in the links above though, because it’s XML content and it’s probably being interpreted by the page. Would be interested to see it in full if it’s posted anywhere else?

1 Like

You can download the raw XML .bes file from bigfix.me, import it into a console and look at it there. You could also just open the raw XML .bes file in a text editor, but then you will miss out on the syntax highlighting in the console and you’ll have to try to read the data within the XML itself which is a bit hard when it also involves relevance that creates XML.

Cool - I’ll check it out! Thanks for the info

1 Like

@jgstew can you post a source for the CURL download? The download URL listed in the Fixlet is not working.

1 Like

The cURL downloads do tend to break over time and then need to be updated, but in this case it still appears to work. I just checked it.

The info in that prefetch should match this: https://www.virustotal.com/en/file/56bb84b3671b21fd41d497d88fba6cad72937312697423fa0fe7a3f1a37e0ad1/analysis/1439081379/


Whenever the cURL download does break:

  • I go here: http://curl.haxx.se/download.html
  • I go to the Win32 - Generic section.
  • I find the options with SSL
  • I look for one in either CAB or ZIP or 7zip format.
  • I typically go for the latest version available.
  • I test it to make sure it works
  • I update all of my Fixlets & Tasks that use cURL

The problem is, that I don’t actually know that the download is broken until someone tells me it is because my root server already has a cache of the existing download, so it just serves it up from the cache.

Someday it would be neat to write a REST API thing that would just update all of the prefetches to swap out for a newer version of 7zip or cURL or a similar utility for all of the items that use them.

It would be nice if IBM made their open source builds public for certain utilities that are useful for BigFix like cURL like they did with unzip.exe

CC: @AlanM , @steve

https://www.virustotal.com/en/ip-address/80.150.6.138/information/

It seems that the IP address that hosts the http://skanthak.homepage.t-online.de site has been found to host Malware, and our upstream network provider appears to be blocking access to the IP address itself.

I’ll see if I can download the file manually from home tonight.

1 Like

Well that is another good reason to have an alternative source for cURL.

Here is a new method I just came up with once I discovered the “Format” inspector: https://bigfix.me/relevance/details/3008616

Q: ( format "P{0}DT{1}H{2}M{3}S" + it / (1*day) of it + it mod (1*day) / (1*hour) + it mod (1*hour) / (1*minute) + it mod (1*minute) / (1*second) ) of ("26 days, 18:36:56" as time interval)
A: P26DT18H36M56S

This relevance converts a time interval object into a formatted string for use in action start & end times, which are in the StartDateTimeLocalOffset or EndDateTimeLocalOffset XML.


Related:

3 Likes

That is awesome…I really have to review the reference documentation more. Thanks for sharing, James!

1 Like

Same here. I discovered the format inspector on Friday and it blew my mind.

And now instead of doing this unholy mess:

q: ((month of it as two digits & "/" & day_of_month of it as two digits & "/" & year of it as string) of date (local time zone) of it & " " & ((if (hour_of_day of it > 12) then (hour_of_day of it - 12) else (if (hour_of_day of it = 0) then (12) else (hour_of_day of it))) as string & ":" & (two digit minute of it) as string & " " & (if (hour_of_day of it > 11) then ("PM") else ("AM"))) of time (local time zone) of it) of (modification time of file "C:\systag.bin") | "File Missing"
A: 12/16/2015 11:05 AM

I can just do this:

q: (format "{0}" + modification time of file "C:\systag.bin") as string | "File Missing"
A: 12/16/2015 11:05:45 AM
3 Likes