Absolute Expressionįrom April 1st, 2017 at 8:32 PM until April 1st, 2017 at 8:35 PM.įrom midnight April 1st to midnight April 2nd of the current year.įrom midnight April 1st, 2014 to midnight April 2nd, 2017.įrom midnight April 1st, 2017 to midnight April 2nd, 2017. The table below contains examples of absolute time-range expressions. There are many different ways to combine year, month, and days in an absolute time range expression. Search time ranges use either the default date format set in your web browser or the Date Format setting on the Preferences page, if you have set it. To avoid indeterminate values, always enter the year in the format YYYY. If no year is present in an absolute time expression, the current year is assumed. The Sumo Logic Format operator supports all Java String.format syntax, as defined in. Again, the token "now" represents the current time. Using diff with timeslice, you can run a query similar to. If only a date is entered, the time value is implied to be midnight. If two expressions are present, the first one is interpreted as the start time, the second is interpreted as the end time. If only one time expression is present, it is interpreted as the start time. While relative expressions are useful, sometimes it is more important to express a specific point in time. The table below contains examples of relative time-range expressions. The remainder of the expression contains a number and a time multiplier.įuture time expressions (for example, now to +15m) are supported and will return results if timestamps for any collected data are set in the future. If two expressions are present, the first one is interpreted as the start time, and the second one is the end time.Įxpressions should be prefixed with "-" to indicate that the time resolves to the past.The token "now" can be entered to mean the current time. If only one expression is present, it is interpreted as the start time, and the end time is automatically set to "now".Search time ranges use either the default timezone set in your web browser, or the Default Timezone setting on the Preferences page, if you have set it.Įither a single relative expression or two relative expressions can be In cases where more control of the start and end time is required, you can type a time range expression directly into the time range field. Preset values are available to choose from, with Last 15 Minutes as the default start value and "now" being the implied end time. The last millisecond of the defined time range is not searched. When you are building a search query, you have the option to add a time range expression in the time range field.
0 Comments
Leave a Reply. |