5 Replies Latest reply: Jun 20, 2014 9:14 AM by Christopher White RSS

SteelScript TimeFilter use

John Sutch

Hello all, I'm new to both Python and to SteelScript and I'm trying to use SteelScript to create a trace clip on a NetShark. I have created both my NetShark object and my capture job object and I'm now trying to create the clip. According to the documentation I should use the add_clip method, the syntax of which is: add_clip(filters, description, locked=True). The problem I have is that I cannot work out the syntax of the filters parameter. I wish to create a simple filter to create a 10 minute clip from the capture job. I have looked at the TimeFilter documentation too and created a TimeFilter object with a start and end datetime, but probably due to my inexperience with Python I can't seem to get it to work with add_clip. If I use that object as the filter I get an error stating the object is not iterable.

My first question is what should the format of the datetime be in the TimeFilter object?

Secondly, how is that TimeFilter object used in the add_clip filter parameter?

Has anyone already done something similar using the TimeFilter? If so, please would you share your experience with me?

Apologies if I've used any incorrect terminology - it's somewhat of a learning curve for me!

Thanks,     John.

  • Re: SteelScript TimeFilter use
    Joe Kraenzle



    I've only used TimeFilter in NetProfiler reporting so I may not completely understand what you need to do.  Examples of TimeFilter use are:


    timefilter = TimeFilter.parse_range("last 60 m")


    report.run (groupby, columns, timefilter=timefilter, trafficexpr=trafficexpr, resolution=resolution, centricity=centricity




    It can also be set by passing arguments to a Python script.


    group.add_option('--timefilter', dest='timefilter', default='last 1 hour',  help='Time range to analyze (defaults to "last 1 hour") other valid formats are: "4/21/13 4:00 to 4/21/13 5:00" or "16:00:00 to 21:00:04.546"'


    The test code shipped with SteelScript has the following use of the filter in the add_clip (...), where filters is passed as an array including the TimeFilter.


    def test_create_clip(self):
        interface = self.shark.get_interfaces()[0]
        job = self.shark.create_job(interface, 'test_create_clip', '300M')
        filters = [TimeFilter(datetime.datetime.now() - datetime.timedelta(1),
        clip = self.shark.create_clip(job,  filters, description='test_clip')
        #lets create a clip from a job
        with job.add_clip(filters, 'test_add_clip') as clip:


    Good luck!



    • Re: SteelScript TimeFilter use
      John Sutch

      Thanks Joe. That helped a lot. I hadn't seen the example you referred to. I now have it working.

      • Re: SteelScript TimeFilter use
        Rossel Vermette

        Here is another similar way of passing time arguments, instead of using a relative point as a reference you can specify the start/end date/time,

        import argparse
        parser = argparse.ArgumentParser(description='Parameter options')
        parser.add_argument('-sd','--sdate',help='Start Date',required=True)
        parser.add_argument('-ed','--edate',help='End Date',required=True)
        parser.add_argument('-st','--stime',help='Start Time',required=True)
        parser.add_argument('-et','--etime',help='End Time',required=True)
        rargs = parser.parse_args()


        Then you can parse the time:


        t0 = TimeParser.parse_one('{s1} {s2}'.format(s1=rargs.sdate, s2=rargs.stime) )
        t1 = TimeParser.parse_one('{e1} {e2}'.format(e1=rargs.edate, e2=rargs.etime) )
        timefilter = TimeFilter(t0,t1)
  • Re: SteelScript TimeFilter use
    Christopher White

    Hey John,


    Looks like Joe and Rossel got you going in the right direction, but I thought I'd add a bit about datetime objects.


    If you want to create a TimeFilter object manually, you need to pass it start and end times as standard Python datetime objects.  They can be a bit finicky to create directly:


    >>> import datetime
    >>> jun1 = datetime.datetime(2014,7,1,13,00)
    >>> jun1
    datetime.datetime(2014, 7, 1, 13, 0)
    >>> str(jun1)
    '2014-07-01 13:00:00'

    First off, is the repeated "datetime.datetime" -- looks odd, but it's basically because of namespacing.  The first datetime is the name of the module, the second is the name of the particular class of datetime object that you want to instantiate from that module.  (For example, there is also a datetime.timedelta class that represents the difference between two datetime objects).


    The constructor just takes year, month, day, hour, minute, second.  See the above datetime object reference to the Python docs for details.


    I'll note that the above does not have a timezone -- so it will be interpreted as "local time" of the machine you run it on.  Often that is ok, but always be wary of timezones.  If you think you have everything working but you're not getting back any data, always verify that someone didn't accidentally interpret your start/end times as the wrong timezone, it's happened to me more times than I care to admin...


    Usually if I want a datetime object, you can use the dateutil package (has to be installed separately, as it's not yet standard):


    >>> import dateutil.parser
    >>> jun1 = dateutil.parser.parse("6/1/2014 13:00")
    >>> jun1
    datetime.datetime(2014, 6, 1, 13, 0)
    >>> dateutil.parser.parse("6/1/2014 13:00")
    datetime.datetime(2014, 6, 1, 13, 0)
    >>> dateutil.parser.parse("6/1/2014 1:00 pm")
    datetime.datetime(2014, 6, 1, 13, 0)
    >>> dateutil.parser.parse("2014 Jun 1 1:00 pm")
    datetime.datetime(2014, 6, 1, 13, 0)
    >>> dateutil.parser.parse("2014 Jun 1 1:00 pm UTC")
    datetime.datetime(2014, 6, 1, 13, 0, tzinfo=tzutc())
    >>> dateutil.parser.parse("2014 Jun 1 1:00 pm EST")
    datetime.datetime(2014, 6, 1, 13, 0, tzinfo=tzlocal())

    The great thing about dateutil parser is that it does a fantastic job of parsing just about any possible string input format, so if you're parsing datetime strings from user input or a log file, this is often the best way to go.