In most of your queries, you will want to specify a time range other than the default setting. This article shows how to use time settings in a query, then explains how Scuba handles relative time.
This article is specific to Time view. Time view is the default graph displayed for Explore view.
Using time settings in a query
Specify start and end times
This section shows the various ways you can specify start and end times.
- In the query definition, next to Starting, click the value and select from the drop-down menu, or type any value. Do the same for Ending.
- In the query definition, on the end of the line with Starting, click the calendar icon. Select a day, then specify hours, minutes, and seconds by clicking the respective up and down arrows.
- At the bottom of the Explore window, use the time scrubber to pick a range. The time scrubber is a visual equivalent of the starting and ending times in the query definition, and as you adjust either the query definition or the time scrubber, the other one updates to reflect the change.
The time scrubber rounds the start and end values to the nearest 15 minutes, if the selected time range is less than 48 hours. If the you scrub beyond 48 hours, the start and end values snap to the start and end of the selected days.
Set the time resolution and trailing window
You can specify the time resolution of the data points plotted on the Time view graph, as well as setting the trailing window over which the data points are scanned. These settings determine the granularity of events for the query.
You can set a trailing window for an actor property, in addition to setting one in the top-level query. If the trailing window for an actor property differs from that specified for the top-level query, the actor property trailing window applies for the calculation of the actor property value..
To set the time resolution and trailing window, do the following:
- In the query definition, below the starting and ending times, click the plus sign next to time options. Default options, determined by your starting and ending time range, display initially.
Scuba chooses auto default time options for time resolution and trailing window based on the time range you choose. For longer time ranges, Scuba chooses larger units of time resolution.
- To set the time resolution, click the first auto option and choose from the dropdown list. The trailing window changes to match your selection.
- To specify a different trailing window, choose from the trailing dropdown list, or type a new interval.
- Click Go to run the query and view the results.
- Validate your trailing window in the results pane by mousing over two adjacent data points and comparing their time ranges.
How Scuba handles relative time
You can specify absolute time or relative time in a query. The following sections describe settings for relative time.
When you construct a query, you specify the time over which the query will scan for results by choosing intervals from drop-down menus or entering custom values. The sentence model query builder allows you to specify non-uniform intervals, such as year, month, and calendar quarter, as well as uniform intervals such as seconds, minutes, hours, and days.
The following table summarizes the delimiters used with non-uniform time intervals.
|Time interval||Relative value|
|Beginning of time||Start of first event|
You can specify an exact time to snap to in the Explorer time windows, for example by typing 12:12:42 exactly in the time field. If you do not specify a custom snap time, the following defaults are used.
|Time interval||Snap default|
|Hours||Start at the top of the hour|
|Days||Start at 00:00:00|
|Weeks||Start on Sunday at 00:00:00|
|Months||Start on the 1st at 00:00:00|
|Years||Start on 1/1 at 00:00:00|
For example, if your time range is specified as 4 weeks, by default Scuba snaps to the beginning of the week (Sunday at midnight). In contrast, if you specify 28 days, Scuba snaps to today at midnight