From 69cc9c062cc0e89c20e24e414a680cd4acfde8e3 Mon Sep 17 00:00:00 2001
From: Alexander Zangerl <alexz@opmantek.com>
Date: Wed, 11 May 2016 14:03:12 +1000
Subject: [PATCH] added formats %tsr, %ter and %trr for printing raw,
 fractional unix timestamps

---
 bin/nf_common.c | 28 ++++++++++++++++++++++++++++
 man/nfdump.1    |  6 ++++++
 2 files changed, 34 insertions(+)

diff --git a/bin/nf_common.c b/bin/nf_common.c
index 241a818..93f6aa7 100644
--- a/bin/nf_common.c
+++ b/bin/nf_common.c
@@ -104,6 +104,12 @@ static void String_LastSeen(master_record_t *r, char *string);
 
 static void String_Received(master_record_t *r, char *string);
 
+static void String_FirstSeenRaw(master_record_t *r, char *string);
+
+static void String_LastSeenRaw(master_record_t *r, char *string);
+
+static void String_ReceivedRaw(master_record_t *r, char *string);
+
 static void String_Duration(master_record_t *r, char *string);
 
 static void String_Protocol(master_record_t *r, char *string);
@@ -274,8 +280,11 @@ static struct format_token_list_s {
 	{ "%ff", 0, "Flow Flags", 				String_FlowFlags }, 	// flow flags in hex
 	{ "%tfs", 0, "Date first seen        ", String_FirstSeen },		// Start Time - first seen
 	{ "%ts",  0, "Date first seen        ", String_FirstSeen },		// Start Time - first seen
+	{ "%tsr",  0, "Date first seen (raw)    ", String_FirstSeenRaw },		// Start Time - first seen, seconds
 	{ "%te",  0, "Date last seen         ", String_LastSeen },		// End Time	- last seen
+	{ "%ter",  0, "Date last seen (raw)     ", String_LastSeenRaw },		// End Time - first seen, seconds
 	{ "%tr",  0, "Date flow received     ", String_Received },		// Received Time
+	{ "%trr",  0, "Date flow received (raw)  ", String_ReceivedRaw },		// Received Time, seconds
 	{ "%td",  0, " Duration", 				String_Duration },		// Duration
 	{ "%exp", 0, "Exp ID", 				 	String_ExpSysID },		// Exporter SysID
 	{ "%pr",  0, "Proto", 					String_Protocol },		// Protocol
@@ -1859,6 +1868,25 @@ char 	*s;
 
 } // End of String_Received
 
+static void String_ReceivedRaw(master_record_t *r, char *string)
+{
+	 /* snprintf does write \0, and the max is INCL the terminating \0 */
+	 snprintf(string, MAX_STRING_LENGTH, "%.3f", r->received/1000.0);
+}
+
+static void String_FirstSeenRaw(master_record_t *r, char *string)
+{
+	 /* snprintf does write \0, and the max is INCL the terminating \0 */
+	 snprintf(string, MAX_STRING_LENGTH, "%.3f", r->first/1000.0);
+}
+
+static void String_LastSeenRaw(master_record_t *r, char *string)
+{
+	 /* snprintf does write \0, and the max is INCL the terminating \0 */
+	 snprintf(string, MAX_STRING_LENGTH, "%.3f", r->last/1000.0);
+}
+
+
 #ifdef NSEL
 static void String_EventTime(master_record_t *r, char *string) {
 time_t 	tt;
diff --git a/man/nfdump.1 b/man/nfdump.1
index 1eec0be..1b61133 100755
--- a/man/nfdump.1
+++ b/man/nfdump.1
@@ -601,10 +601,16 @@ and format specifier as described below
 .br
 \fB%ts\fR       Start Time \- first seen
 .br
+\fB%tsr\fR      Start Time, but in fractional seconds since the epoch (1970-01-01)
+.br
 \fB%te\fR       End Time \- last seen
 .br
+\fB%ter\fR      End Time, in fractional seconds
+.br
 \fB%tr\fR       Time the flow was received by the collector
 .br
+\fB%trr\fR      Time the flow was received, in fractional seconds
+.br
 \fB%td\fR       Duration
 .br
 \fB%pr\fR       Protocol