Specifying time spans

Some SPL2 commands include an argument where you can specify a time span, which is used to organize the search results by time increments. The GROUP BY clause in the from command, and the bin, stats, and timechart commands include a span argument.

The time span can contain two elements, a time unit and timescale:

• A time unit is an integer that designates the amount of time, for example 5 or 30.
• A timescale is word or abbreviation that designates the time interval, for example seconds, minutes, or hours.

When you specify a time span, the timescale is required. If no time unit is specified, 1 is used as the default time unit. For example if you specify min, 1 minute is used.

Supported timescales

The supported timescale intervals are listed in the following table:

Timescale interval	Valid abbreviations
second	s, sec, secs, second, seconds
minute	m, min, minute, minutes
hour	h, hr, hrs, hour, hours
day	d, day, days
week	w, week, weeks
month	mon, month, months
quarter	q, qtr, qtrs, quarter, quarters
year	y, yr, yrs, year, years

Default time span

If you use the predefined time ranges in the Time Range Picker, and do not specify a span argument, the following table shows the default spans that are used:

Time range	Default time span
Last 15 minutes	10 seconds
Last 60 minutes	1 minute
Last 4 hours	5 minutes
Last 24 hours	30 minutes
Last 7 days	1 day
Last 30 days	1 day
Previous year	1 month