The next thing, renaming columns--
so if you don't like the column name,
if you didn't like ZUSER or ZTIMESTAMP,
ZMESSAGE, change it.
You can change it and say, OK, you
know what, ZUSER as quotes user quote comma, same thing.
So I'm going to do this for you.
And I'm actually OK with how these are named,
but I'm going to pretend I'm not.
I'm going to say AS Warning path AS File Path, whatever
you want it to be.
And then AS Update Time-- no comma because from is there--
notice how it all changed.
So now it says Warning, File Path Update Time.
Excellent.
This is a Unix Epoch timestamp.
So we saw Mac in the slides.
Now we're seeing Unix Epoch.
Something that is so important--
and I would love for everyone to write this down at this point.
Unix is going to start with 13, 14, 15, or 16.
And what I mean by that is, in any timestamp column starts
with 13, 14, 15, 16.
Mac starts with 3, 4, 5, or 6.
The reason I'm telling you this--
I hope on your GIACs, you get hit with a table and it says,
what type of timestamp is this?
Because of my quizzing, hopefully it
takes you 5 to 10 seconds to know the answer,
and you answer it, which gives you
more time to look at other questions that
could be more challenging.
You also need to know this to write the query.
Because no one can read that.
No one knows what that means when you see 497800782.474.
Not readable.
You have to understand how to do the math conversion to make
that a readable timestamp.
How we handle Mac is different than how we handle Unix.
Now, for Unix, what you want to do is count.
So we have 1, 2, 3, 4, 5, 6, 7, 8, 9, 10.
Unix Epoch, 10 digits in length.
Unix Epoch millisecond 13.
So if I were you right now, I would get out my notebook,
and I would write Mac timestamp start with 3, 4, 5, or 6.
The column name does not matter.
Unix Epoch starts with 13, 14, 15, 16,
and it's 10 digits in length.
Unix Epoch millisecond 13, 14, 15, 16
and is 13 digits in length.
If you have your little PDF cheat sheet,
you can print that.
Write it on it.
Just write it down until you've exhausted it,
and it's so sharp in your mind that you can just count.
I'm to the point now where I can look
I'm like, yeah, that's more than 10 milliseconds.
That way you're not guessing on the math.
Because this is what's coming next.