Splunk® Cloud Services

SPL2 Search Manual

Acrobat logo Download manual as PDF

Acrobat logo Download topic as PDF

Specifying time spans

Some SPL2 commands include an argument where you can specify a time span, which is used to organize the search results by time increments. The GROUP BY clause in the from command, and the bin, stats, and timechart commands include a span argument.

The time span can contain two elements, a time unit and timescale:

  • A time unit is an integer that designates the amount of time, for example 5 or 30.
  • A timescale is word or abbreviation that designates the time interval, for example seconds, minutes, or hours.

When you specify a time span, the timescale is required. If no time unit is specified, 1 is used as the default time unit. For example if you specify min, 1 minute is used.

Supported timescales

The supported timescale intervals are listed in the following table:

Timescale interval Valid abbreviations
second s, sec, secs, second, seconds
minute m, min, minute, minutes
hour h, hr, hrs, hour, hours
day d, day, days
week w, week, weeks
month mon, month, months
quarter q, qtr, qtrs, quarter, quarters
year y, yr, yrs, year, years

Default time span

If you use the predefined time ranges in the Time Range Picker, and do not specify a span argument, the following table shows the default spans that are used:

Time range Default time span
Last 15 minutes 10 seconds
Last 60 minutes 1 minute
Last 4 hours 5 minutes
Last 24 hours 30 minutes
Last 7 days 1 day
Last 30 days 1 day
Previous year 1 month
Last modified on 23 October, 2023
Specifying relative time
Using time variables

This documentation applies to the following versions of Splunk® Cloud Services: current

Was this documentation topic helpful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters