Manipulating and comparing dates / manual wrong?

This shouldn’t be rocket science, but it’s beginning to look like it is.
I’m trying to scan a set of firewall address-list elements to see which one was most recently added. That means doing date comparisons. I can’t get them to work.
I’ve determined that when I do [/ip firewall address-list get [find list=“listname”] creation-time], I get strings, not date values. Fine, once I realize that, I can work with it.
So I’ve been keeping all my date values as strings and then using :totime only at the point of comparison… but the comparison never functions correctly.
Upon examination, any attempt to convert a date-time string to a time value seems to fail miserably:

[me@myrouter] > {
{... :local foo "feb/28/2021 19:01:33";        
{... :put [:typeof $foo]                       
{... }                                  
str                          // right, I expected that...
[me@myrouter] >             
[me@myrouter] > {
{... :local foo [:totime "feb/28/2021 19:01:33"];        
{... :put [:typeof $foo]                                 
{... }                                  
nil
[me@myrouter] >

Now… if I use strings representing times only (e.g., “12:30:04”), I no longer get nil, but time, and the values look correct.
Note that the scripting guide states that the time data type is a “date and time value.” However, it doesn’t look as if they are actually treated that way.
On the third hand, the guide uses (date) instead of (time) to describe data elements such as last-started (in /system script)… but there is no “date” data type. There certainly isn’t a :todate builtin (I tried it).

To summarize, the manual defines the time data type inconsistently, and there doesn’t seem to be a way to convert a time-with-date string into a time variable.
Is there a way to do what I want to do without a lot of rocket science?

(Ironically, this task was undertaken solely because there doesn’t seem to be a way to do what I REALLY want to do, which is to have a firewall rule shoot off an email.)

It can be done, buts not simple. You have to take care that in current day format of log are no equal as the rest of the logs.


I have commented this several time.
http://forum.mikrotik.com/t/how-to-get-log-records-for-last-5-mins/70398/7
MT should change to use RFC-3164 time format everywhere.
In a support email, they say they will look inn to it. But even 7.x is not in RFC format.

Workaround: Send log to an syslog server (Eks Splunk)

I appreciate your input, but your advice seems entirely log-specific. I am not doing anything with logs. I am working with scripts and date-time variables/data fields in configuration records.

If time has been available in epoc time and shown in readable format in view, calculation of time would have been easy.