Search using time bins and spans

Using commands to create time bins

You can use the bin, chart, and timechart commands to organize your search results into time bins.

Time bins are calculated based on <bin-options> settings, such as bins and span. For example, the bins option sets the maximum number of bins to discretize into. This does not set the target number of bins. It finds the smallest bin size that results in no more than N distinct bins. Even though you specify a number such as 300, the resulting number of bins might be much lower.

See the command information on the specific use of time bins in the Search Reference:

• bin
• chart
• timechart

Time zones and time bins

When the time bins cross multiple days or months the bins are aligned to the local day boundary.

The events returned are the same for the time range since the events are processed using UNIX time. But some events in might appear in one bin in a timezone, and in another bin in a different timezone.

How specifying a time range influences time bins

When you specify a time range, either through the time range picker or explicitly in the search with the "earliest" and "latest" time modifiers, the events are processed based on which time range is used.
See Time modifiers in the Search Reference.

If the search specifies "Last 24 hours", then the search processes the events using UTC time. The same set of events are returned for a user in San Francisco and a user in Tokyo.

If the search specifies "Today", the search processes events based on the midnight of the timezone, not UTC time. A different set of events are returned for a user in San Francisco and a user in Tokyo, because the time that midnight occurs is different in each timezone.

If the search uses a snap-to time, such as @d or @mon, the search processes events based on the "day" or "month" of the timezone, not UTC time. A different set of events are returned for a user in SF and a user in Tokyo, because the time that midnight occurs is different in each timezone.
See Specify a snap to time unit in the Search Reference.

See also

Related information

About searching with time

Select time ranges to apply to your search

Specify time modifiers in your search

How time zones are processed by the Splunk platform