---
title: Create variables for timestamp calculations
description: Define reusable query variables with `create`, such as a parsed timestamp and the interval since the event using `formatInterval`.
url: https://coralogix.com/docs/dataprime/cookbook/timestamp_variables/
product: dataengine
feature: DataPrime Language
feature_id: dataprime-language
feature_identifier: dataengine/dataprime-language
last_updated: '2026-11-02'
---

# Create variables for timestamp calculations

## Problem / use case

You want to define intermediate values in your DataPrime query, like a parsed timestamp or a calculated time difference, so you can reuse or manipulate them later in the query. Use [parseTimestamp](https://coralogix.com/docs/dataprime/language-reference/functions-reference/time/parsetimestamp.md) and [formatInterval](https://coralogix.com/docs/dataprime/language-reference/functions-reference/time/formatinterval.md).

## Query

```
source logs

| filter @timestamp != null

| create parsed_time from parseTimestamp(@timestamp:string)

| create seconds_since_event from (now() - parsed_time).formatInterval('s')
```

## Explanation

This query creates two variables:

* `parsed_time`: a reusable timestamp field, created once and referenced later.
* `seconds_since_event`: a calculated interval using that variable, formatted for readability.

Using `create` this way improves clarity, avoids repeated expressions, and lets you chain logic step-by-step.

## Output

```
{

  "timestamp": "2025-05-26T13:59:57.32905204Z",

  ...,

  "parsed_time": 1748267997329052200,

  "seconds_since_event": "77174s615ms947us960ns"

}
```

***

## Variations

Add a label for events that happened more than 5 minutes ago:

```
create is_old_event from (now() - parsed_time) > 5.toInterval('m')
```

## Output

```
{

  "timestamp": "2025-05-26T13:59:57.32905204Z",

  ...,

  "parsed_time": 1748267997329052200,

  "seconds_since_event": "77174s615ms947us960ns",

  "is_old_event": true,  // will be true or false depending on how old the log is

  "parsed_time": 1748249999747348700,

  "seconds_since_event": "95373s327ms651us193ns",

}
```

***

Truncate or format the timestamp:

```
create readable_time from parsed_time.formatTimestamp('%H:%M:%S')
```

## Output

```
{

  "timestamp": "2025-05-26T13:59:57.32905204Z",

  ...,

  "parsed_time": 1748267997329052200,

  "seconds_since_event": "77174s615ms947us960ns",

  "is_old_event": true,

  "parsed_time": 1748249999747348700,

  "readable_time": "08:59:59",

  "seconds_since_event": "95373s327ms651us193ns",

}
```

## TL;DR

Use `create <name> from <expression>` to define reusable variables in your query. This keeps complex logic readable and avoids repeating expressions like `parseTimestamp(@timestamp)`.