Splunk® Enterprise

Search Manual

Acrobat logo Download manual as PDF


Acrobat logo Download topic as PDF

Search using time bins and spans

Time zones and time bins

You can use the bin, chart, and timechart commands to organize your search results into time bins.

Time bins are calculated based on <bin-options> settings, such as bins and span.

When the time bins cross multiple days or months the bins are aligned to the local day boundary.

The events returned are the same for the time range since the events are processed using UNIX time. But some events in might appear in one bin in a timezone, and in another bin in a different timezone.

Another example is the time range for the search.

When you specify a time range, either through the time range picker or explicitly in the search with the "earliest" and "latest" time (modifiers), the events are processed based on which time range is used.

If the search specifies "Last 24 hours", then the search processes the events using UTC time. The same set of events are returned for a user in SF and a user in Tokyo.

If the search specifies "Since midnight today", the search processes events based on the midnight of the timezone, not UTC time. A different set of events are returned for a user in SF and a user in Tokyo, because the time that midnight occurs is different in each timezone.

If the search uses a snap-to time, such as @d or @mon, the search processes events based on the "day" or "month" of the timezone, not UTC time. A different set of events are returned for a user in SF and a user in Tokyo, because the time that midnight occurs is different in each timezone.

Last modified on 20 December, 2022
PREVIOUS
Use time to find nearby events
  NEXT
How time zones are processed by the Splunk platform

This documentation applies to the following versions of Splunk® Enterprise: 8.2.0, 8.2.1, 8.2.2, 8.2.3, 8.2.4, 8.2.5, 8.2.6, 8.2.7, 8.2.8, 8.2.9, 8.2.10, 8.2.11, 8.2.12, 9.0.0, 9.0.1, 9.0.2, 9.0.3, 9.0.4, 9.0.5, 9.0.6, 9.0.7, 9.0.8, 9.0.9, 9.1.0, 9.1.1, 9.1.2, 9.1.3, 9.1.4, 9.2.0, 9.2.1


Was this documentation topic helpful?


You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters