Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Original file line number Diff line number Diff line change
Expand Up @@ -17,23 +17,13 @@ The current time range is displayed, along with the following options to set the
* **Custom**. Click a date to select it as the start date, then move your cursor to the desired end date and click to select it. The date settings shown below the calendar are updated. You can scroll to navigate between months or click to go to a specific month. To specify the time, highlight the portion of the time value you want to change, and modify the entry.<br/><img src={useBaseUrl('img/reuse/query-search/time-range-custom.png')} alt="Time range custom" style={{border: '1px solid gray'}} width="200" />
* **Recent**. If you have specified any relative or custom time ranges during your current login session, they are available for selection under **Recent**.

#### Rules

The following general rules apply to time ranges:

* For all time expressions with only one start time entered, the default assumed end-time is "now".
* If you enter two times, the first is assumed to be the start time, and the second is assumed to be the end time for the time range.
* When entering hours, you can use a 24-hour format, such as 17:32:00, or a 12-hour format, such as 5:32pm.
* To enter dates, always use a slash (`/`) between month, day, and year in this format: mm/dd/yyyy. Sumo Logic does not support dates entered in yyyy/mm/dd notation or yy/mm/dd notation.
* Abbreviations for custom time are h=hours, d=days, w=weeks, m=months.
* If you enter a date, the assumed time for the date is midnight of that day. (00:00:00).
* For relative time, use these shorthand entries: d=day, h=hour, m=minute, and s=second.
* You can enter relative time ranges like this: "-1d -12h" for the range between one day ago and 12 hours ago.
* Time ranges use either the default timezone set in your web browser, or the [Default Timezone](../../../get-started/account-settings-preferences.md) setting on the **Preferences** page, if you have set it.
#### Display details

* The timezone offset is displayed in the time range selector pop-up dialog. For example, in the previous screenshot, +1100 is added to display the offset for Australia, including DST.
* The timezone offset is also displayed in the **Time** column of the **Messages** tab in search results.
* The last millisecond of the defined time range is not searched. For example, a time range of 6:15 to 6.30 pm will run as 6:15:00:000 to 6:29:59:999.
* The timezone offset is also displayed in the **Time** column of the **Messages** tab in search results.

For more information about entering time ranges, see [Time Range Expressions](/docs/search/get-started-with-search/search-basics/time-range-expressions).
For the syntax rules for typing relative and absolute time range expressions directly into the time range field, see [Time Range Expressions](/docs/search/get-started-with-search/search-basics/time-range-expressions).

Time range options can vary depending on the type of account your organization has. Sumo Logic Free accounts allow time ranges up to seven days.
:::note
This page covers how to set the time period a search looks at. By default, that period is measured against message time. To measure it against a different timestamp field instead, see [Use Receipt Time](/docs/search/get-started-with-search/build-search/use-receipt-time) or [Use Searchable Time](/docs/search/get-started-with-search/build-search/use-searchable-time).
:::
Original file line number Diff line number Diff line change
Expand Up @@ -10,6 +10,10 @@ By default, log searches run by Message time. Enable the **Use Receipt Time** se

To search data based on the order that Collectors received the messages use **Receipt Time**. This option has the search reference the [metadata](../search-basics/built-in-metadata.md) field `_receiptTime` instead of `_messageTime`, giving you the ability to view the difference in the parsed [timestamp](/docs/send-data/reference-information/time-reference) (`_messageTime`) and receipt time (`_receiptTime`) to pinpoint Sources that may be parsing the message's timestamps incorrectly.

:::note
This setting controls which timestamp field a search's time range is measured against, not the time range itself. To set the time range, see [Set the Time Range of a Search](/docs/search/get-started-with-search/build-search/set-time-range). Receipt time is one of three timestamp fields you can search by, along with message time (the default) and [searchable time](/docs/search/get-started-with-search/build-search/use-searchable-time), the time when a message became available for search.
:::

## Run a search by Receipt Time

To run a log search by Receipt Time:
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,10 @@ import useBaseUrl from '@docusaurus/useBaseUrl';

This resolves the inconsistent error messages due to variable ingestion latency and non-linear receipt time indexing issues by marking the time only when the data is truly searchable. This ensures running queries with non-overlapping but exhaustive time ranges will prevent any gaps or duplication in the data.

:::note
This setting controls which timestamp field a search's time range is measured against, not the time range itself. To set the time range, see [Set the Time Range of a Search](/docs/search/get-started-with-search/build-search/set-time-range). Searchable time is one of three timestamp fields you can search by, along with message time (the default) and [receipt time](/docs/search/get-started-with-search/build-search/use-receipt-time), the time a message hit the Sumo Logic receivers.
:::

:::info
Currently, **Searchable Time** is only available for the Log Search UI page, Scheduled Searches, Saved Searches, Dashboards, Monitors, and Search Job API queries.
:::
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -10,12 +10,23 @@ When you are building a search query, you have the option to add a time range e

The last millisecond of the defined time range is not searched. For example, a time range of 6:15 to 6.30 pm will run as 6:15:00:000 to 6:29:59:999.

## General rules

* When entering hours, you can use a 24-hour format, such as 17:32:00, or a 12-hour format, such as 5:32pm.
* To enter dates, always use a slash (`/`) between month, day, and year in this format: mm/dd/yyyy. Sumo Logic does not support dates entered in yyyy/mm/dd notation or yy/mm/dd notation.
* The Custom time range picker's quick-adjust control uses its own abbreviations: `h`=hours, `d`=days, `w`=weeks, `m`=months. This is a different scale than the [relative expression](#relative-time-range-expressions) shorthand below, where `m` means minute.
* Time range options can vary depending on the type of account your organization has. Sumo Logic Free accounts allow time ranges up to seven days.

## Preset time range expressions

Preset values are available to choose from, with **Last 15 Minutes** as the default start value and "now" being the implied end time. In cases where more control of the start and end time is required, you can type a time range expression directly into the time range field.

Search time ranges use either the default timezone set in your web browser, or the [Default Timezone](../../../get-started/account-settings-preferences.md) setting on the **Preferences** page, if you have set it.

:::note
When you create a [Scheduled Search](/docs/alerts/scheduled-searches), the time range of the search that you save uses the time zone that is set for the Sumo Logic user interface at the time of saving. Changing the **Default Timezone** setting later does not automatically update existing Scheduled Searches or real-time alerts, so edit and save them again to apply the new time zone.
:::

<img src={useBaseUrl('img/search/get-started-search/search-basics/time-range-expressions.png')} alt="Time range expressions" style={{border: '1px solid gray'}} width="300" />

## Relative time range expressions
Expand Down Expand Up @@ -49,12 +60,16 @@ The table below contains examples of relative time-range expressions. 

## Absolute time range expressions

While relative expressions are useful, sometimes it is more important to express a specific point in time. If only one time expression is present, it is interpreted as the start time. If two expressions are present, the first one is interpreted as the start time, the second is interpreted as the end time. If only a date is entered, the time value is implied to be midnight. Again, the token "now" represents the current time. If no year is present in an absolute time expression, the current year is assumed.
While relative expressions are useful, sometimes it is more important to express a specific point in time. If only one time expression is present, it is interpreted as the start time, and the end time is automatically set to "now". If two expressions are present, the first one is interpreted as the start time, the second is interpreted as the end time. If only a date is entered, the time value is implied to be midnight. Again, the token "now" represents the current time. If no year is present in an absolute time expression, the current year is assumed.

To avoid indeterminate values, always enter the year in the format YYYY.

There are many different ways to combine year, month, and days in an absolute time range expression. Search time ranges use either the default **date format** set in your web browser or the [Date Format](../../../get-started/account-settings-preferences.md) setting on the **Preferences** page, if you have set it.

:::note
If your browser is set to a locale that uses day/month/year format instead of month/day/year, dates in the Sumo Logic UI are presented in that format. Absolute time range expressions themselves must still use the mm/dd/yyyy slash format described in [General rules](#general-rules).
:::

The table below contains examples of absolute time-range expressions. 

| Absolute Expression | Definition |
Expand All @@ -65,3 +80,8 @@ The table below contains examples of absolute time-range expressions. 
| 04/01/2017 00:00:00 to 04/02/2017 | From midnight April 1st, 2014 to midnight April 2nd, 2017. |
| 04/01/2017 | From midnight April 1st, 2017 to now. |
| 04/01/2017 04/02/2017 | From midnight April 1st, 2017 to midnight April 2nd, 2017. |

## See also

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
## See also
## Additional resources


- [Set the Time Range of a Search](/docs/search/get-started-with-search/build-search/set-time-range). Use the Relative, Custom, and Recent time range picker in the Search UI instead of typing an expression.
- [Use Receipt Time](/docs/search/get-started-with-search/build-search/use-receipt-time) or [Use Searchable Time](/docs/search/get-started-with-search/build-search/use-searchable-time). Change which timestamp field a search's time range applies to, instead of the default message time.
16 changes: 1 addition & 15 deletions docs/send-data/reference-information/time-reference.md
Original file line number Diff line number Diff line change
Expand Up @@ -273,20 +273,6 @@ They will see the same data, just displayed using their custom set time zone. Fo

<img src={useBaseUrl('img/send-data/timezone_dashboards_compare.png')} alt="Screenshot comparing how dashboards display time zones differently for users with custom time zone settings, highlighting the same data shown in different time zones." width="600"/>

## Time ranges

The **Time Range** field on the **Search** page uses the time zone that is set for the Sumo Logic user interface. This is either the default time zone used in the web browser and set by the operating system, or the **Default Timezone** setting on the **Preferences** page, if you have set this option.

When you create a [Scheduled Search](/docs/alerts/scheduled-searches), the time range of the search that you save uses the time zone that is set for the Sumo Logic user interface. If you have changed the time zone using the **Default Timezone** setting, this time zone will be used for your Scheduled Searches.

:::note
The **Default Timezone** setting does not automatically update the configurations of existing Scheduled Searches or real-time alerts. If you'd like your Scheduled Searches and real-time alerts to use the same time zone as your user interface, you'll need to edit them to do so, and save them.
This page covers timestamp parsing at ingestion time. For how the Search page's Time Range field and time range expressions work, see [Time Range Expressions](/docs/search/get-started-with-search/search-basics/time-range-expressions) and [Set the Time Range of a Search](/docs/search/get-started-with-search/build-search/set-time-range). To search by a different timestamp field instead of the default message time, see [Use Receipt Time](/docs/search/get-started-with-search/build-search/use-receipt-time) or [Use Searchable Time](/docs/search/get-started-with-search/build-search/use-searchable-time).
:::

For more information on time ranges, see [Set the Time Range of a Search](/docs/search/get-started-with-search/build-search/set-time-range).

Search Time Ranges can also search all data with any and all timestamps. For details, see [Use Receipt Time](/docs/search/get-started-with-search/build-search/use-receipt-time).

## Date format

@kimsauce kimsauce Aug 26, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@JV0812 Shouldn't this Date format section stay in there? It's in the title, and I don't see other guidance like that elsewhere in the doc.


If the browser used to access Sumo Logic is in a location that uses the day/month/year format instead of month/day/year, dates are presented in that format.