Synopsis

Classifies the search query result events into time buckets of the specified time period.

Syntax

interval N [seconds,minutes,days,weeks,months]

Required Arguments

N

Syntax: <numeric value>

Description: The number of units of time into which to classify the search query result events

Unit of time

Syntax: seconds, minutes, days, weeks, or months

Description: The unit of time into which to classify the search query result events

Optional Arguments

None

Description

Classifies the search query results according to time period. Must be preceded by a function.

Examples

Example 1:  

* in log.access | count | interval 1 day 

From the events in access log, shows the number of events per day.