ago()
Returns the date that is a specified time span before the current time.
Syntax
ago(SPAN)
Parameters
SPAN- A string representing the time span to subtract from the current time. Write the number and unit together without spaces. The supported units are as follows.
| Unit | Description |
|---|---|
s | Seconds |
m | Minutes |
h | Hours |
d | Days |
w | Weeks |
mon | Months (only 1, 2, 3, 4, 6 allowed) |
y | Years (only 1 allowed) |
Description
The ago() function returns the date corresponding to current time - SPAN. SPAN is evaluated once at query parse time and remains fixed. The return type is timestamp.
Error codes
Parse errors
| Error code | Message | Description |
|---|---|---|
| 90500 | invalid-timespan | A value other than 1, 2, 3, 4, or 6 is specified for the mon unit |
| 90501 | year should be 1 | A value other than 1 is specified for the y unit |
| 90502 | invalid time unit | An unsupported time unit is specified |
| 90503 | invalid timespan number [value] | An invalid number is specified |
Runtime errors
N/A
Usage examples
To prepare the WEB_APACHE_SAMPLE table used in these examples, refer to Preparing sample data.
-
Retrieve only access log entries from the last 1 hour.
table WEB_APACHE_SAMPLE | search _time >= ago("1h") | fields _time, src_ip, uri, status -
Retrieve only access log entries from the last 7 days.
table WEB_APACHE_SAMPLE | search _time >= ago("7d") | fields _time, src_ip, uri, status
Compatibility
The ago() function has been available since before Sonar 4.0.