Search using time bins and spans

Time zones and time bins

You can use the bin, chart, and timechart commands to organize your search results into time bins.

Time bins are calculated based on <bin-options> settings, such as bins and span.

When the time bins cross multiple days or months the bins are aligned to the local day boundary.

The events returned are the same for the time range since the events are processed using UNIX time. But some events in might appear in one bin in a timezone, and in another bin in a different timezone.

Another example is the time range for the search.

When you specify a time range, either through the time range picker or explicitly in the search with the "earliest" and "latest" time (modifiers), the events are processed based on which time range is used.

If the search specifies "Last 24 hours", then the search processes the events using UTC time. The same set of events are returned for a user in SF and a user in Tokyo.

If the search specifies "Since midnight today", the search processes events based on the midnight of the timezone, not UTC time. A different set of events are returned for a user in SF and a user in Tokyo, because the time that midnight occurs is different in each timezone.

If the search uses a snap-to time, such as @d or @mon, the search processes events based on the "day" or "month" of the timezone, not UTC time. A different set of events are returned for a user in SF and a user in Tokyo, because the time that midnight occurs is different in each timezone.