Synopsis
Classifies the search query result events into time buckets of the specified time period.
Syntax
interval N [seconds,minutes,days,weeks,months]
Required Arguments
N
Syntax: <numeric value>
Description: The number of units of time into which to classify the search query result events
Unit of time
Syntax: seconds, minutes, days, weeks, or months
Description: The unit of time into which to classify the search query result events
Optional Arguments
None
Description
Classifies the search query results according to time period. Must be preceded by a function.
Examples
Example 1:
* in log.access | count | interval 1 day
From the events in access log, shows the number of events per day.