Splunk® Cloud Services

SPL2 Search Reference

timewrap command syntax details


[align=now | end]

Required arguments

Syntax: [<int>]<timescale>
Description: A span of each bin, based on time. The timescale is required. The int is not required. If <int> is not specified, 1 is assumed. For example if day is specified for the timescale, 1day is assumed. See the Timescale options section.

Optional arguments

Syntax: align=now | end
Description: Specifies if the wrapping should be aligned to the current time or the end time of the search.
Default: end

Timescale options

Syntax: <sec> | <min> | <hr> | <day> | <week> | <month> | <quarter> | <year>
Description: Time scale units.
Time scale Syntax Description
<sec> s | sec | secs | second | seconds Time scale in seconds.
<min> min | mins | minute | minutes Time scale in minutes.
<hr> h | hr | hrs | hour | hours Time scale in hours.
<day> d | day | days Time scale in days.
<week> w | week | weeks Time scale in weeks.
<month> m | mon | month | months Time scale in months.

The timewrap command uses the abbreviation m to refer to months. Other commands , such as timechart and bin use the abbreviation m to refer to minutes.

<quarter> qtr | quarter | quarters Time scale in quarters
<year> y | yr | year | years Time scale in years.

See also

timewrap command
timewrap command overview
timewrap command usage
timewrap command examples
Last modified on 20 October, 2020
timewrap command overview   timewrap command usage

This documentation applies to the following versions of Splunk® Cloud Services: current

Was this topic useful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters