gentimes
gentimes
Synopsis
Generates time range results. This command is useful in conjunction with the map command.
Syntax
gentimes start=<timestamp> [end=<timestamp>] [<increment>]
Required arguments
- start
- Syntax: start=<timestamp>
- Description: Specify as start time.
- <timestamp>
- Syntax: (MM/DD/YY)?:(HH:MM:SS)?|<int>
- Description: Indicate the time, for example: 10/1/07:12:34:56 (for October 1, 2007 12:34:56) or -5 (five days ago).
Optional arguments
- end
- Syntax: end=<timestamp>
- Description: Specify and end time.
- <increment>
- Syntax: increment=<int>(s|m|h|d)
- Description: Specify a time period to increment from the start time to the end time.
Examples
Example 1: All HOURLY time ranges from oct 1 till oct 5
| gentimes start=10/1/07 end=10/5/07 increment=1hExample 2: All daily time ranges from 30 days ago until 27 days ago
| gentimes start=-30 end=-27Example 3: All daily time ranges from oct 1 till oct 5
| gentimes start=10/1/07 end=10/5/07Example 4: All daily time ranges from oct 25 till today
| gentimes start=10/25/07See also
Answers
Have questions? Visit Splunk Answers and see what questions and answers the Splunk community has using the gentimes command.
This documentation applies to the following versions of Splunk: 4.1 , 4.1.1 , 4.1.2 , 4.1.3 , 4.1.4 , 4.1.5 , 4.1.6 , 4.1.7 , 4.1.8 , 4.2 , 4.2.1 , 4.2.2 , 4.2.3 , 4.2.4 , 4.2.5 , 4.3 , 4.3.1 , 4.3.2 , 4.3.3 , 4.3.4 , 4.3.5 , 4.3.6 , 5.0 , 5.0.1 , 5.0.2 , 5.0.3 View the Article History for its revisions.