timewrap command syntax details
Syntax
- timewrap
- <timewrap-span>
- [align=now | end]
Required arguments
- <timewrap-span>
- Syntax: [<int>]<timescale>
- Description: A span of each bin, based on time. The
timescale
is required. Theint
is not required. If <int> is not specified, 1 is assumed. For example ifday
is specified for the timescale,1day
is assumed. See the Timescale options section.
Optional arguments
- align
- Syntax: align=now | end
- Description: Specifies if the wrapping should be aligned to the current time or the end time of the search.
- Default: end
Timescale options
- <timescale>
- Syntax: <sec> | <min> | <hr> | <day> | <week> | <month> | <quarter> | <year>
- Description: Time scale units.
Time scale Syntax Description <sec> s | sec | secs | second | seconds Time scale in seconds. <min> min | mins | minute | minutes Time scale in minutes. <hr> h | hr | hrs | hour | hours Time scale in hours. <day> d | day | days Time scale in days. <week> w | week | weeks Time scale in weeks. <month> m | mon | month | months Time scale in months.
Thetimewrap
command uses the abbreviationm
to refer to months. Other commands , such astimechart
andbin
use the abbreviationm
to refer to minutes.<quarter> qtr | quarter | quarters Time scale in quarters <year> y | yr | year | years Time scale in years.
See also
- timewrap command
- timewrap command overview
- timewrap command usage
- timewrap command examples
timewrap command overview | timewrap command usage |
This documentation applies to the following versions of Splunk® Cloud Services: current
Feedback submitted, thanks!