extract_time (<timestamp>, <part>)
dataset = xdr_data | alter timepart = extract_time(current_time(), "HOUR") | fields timepart | limit 1