CODEWITHSUNDEEP
neo4jcypher
sectechguy
sectechguy

Reputation: 2117

Neo4j: How do you use datetime property range to statement to query last 15 minutes?

I am working with email data and would like to use an existing query and add to it. I would like to add and where lastseen(which is stored as DateTime) within the last 15 minutes, without typing in the full datetime range in the cypher statement. Something like (lastseen - (datetime() - 15MM)).

Below is a sample Sender nodes properties:

<id>:12662  domain:corp.com  firstseen:"2020-01-14T06:02:33Z"  lastseen:"2020-01-14T06:25:45Z" name:[email protected]  timesseen:300

The following is the query I would like to incorporate the time portion in:

MATCH path = (s:Sender)-->(a:Attachment)-->(:Recipient)
WITH s, COUNT(DISTINCT a) AS cnt, COLLECT(path) AS paths
WHERE cnt >= 2
return paths

Upvotes: 1

Views: 239

Answers (1)

Dave Bennett
Dave Bennett

Reputation: 11216

You could use the duration function to get your range.

The duration mask PT900S is 900 seconds. 

WITH datetime() AS end 
WITH end, end - duration("PT900S") AS start
RETURN start, end, duration.between(end, start)

Incorporated in your query it might look something like this...

MATCH path = (s:Sender)-->(a:Attachment)-->(:Recipient)
WHERE datetime() - duration("PT900S") <= s.lastseen <= datetime()
WITH s, COUNT(DISTINCT a) AS cnt, COLLECT(path) AS paths
WHERE cnt >= 2
RETURN paths

Upvotes: 1

Related Questions