September 17, 2008 at 4:45 pm
We are trying to decypher the last_update_time from the Symantec Endpoint 11 database. It is storing the "check-in" time from the agent as a big int.. 1221691414262 - Approximately 4:44 On Sep 17, 2008
Any ideas on what the conversion process might be would be great! Thanks!
September 17, 2008 at 5:08 pm
It is probably an offset in seconds or milliseconds from some starting point in time.
You might try 1970-01-01 00:00:00.000 (start point for Unix time) as a start time, and use the DATEADD function to to see if it gives you that time.
September 17, 2008 at 6:23 pm
Michael's right. It looks to be ms from 1/1/1970.
If my math is right - that's
9/17/2008 22:43:34.262
I'd assume that's being expressed in GMT time.
----------------------------------------------------------------------------------
Your lack of planning does not constitute an emergency on my part...unless you're my manager...or a director and above...or a really loud-spoken end-user..All right - what was my emergency again?
September 18, 2008 at 9:53 am
Grrrrr. I appreciate the information gentlemen! I am struggling with the conversion code. DATEADD gripes because the data is stored as a BigInt, I've seen several ideas about using Cast and DateADD to make the conversion, 🙁 but I continue to get either dates from 1988, or overflow errors...
any code snippets you are using that I could bootleg?
Thanks again!
September 18, 2008 at 10:57 am
Thanks again for your help, this was actually TONS easier than I originally thought!
DATEADD(ss, A.[LAST_UPDATE_TIME] /1000 - (A.[TIMEZONE] * 60), '01-01-1970 00:00:00')
I basically needed to divide the value by a 1000 to eliminate the Bigint issue for date add, and work the TZ information.
I think this does it! Thanks again for the hints!
:w00t:
Viewing 5 posts - 1 through 4 (of 4 total)
You must be logged in to reply to this topic. Login to reply