You probably know that you can use either exact time ("09/02/2016 12:00:00 pm") or relative time ("today") to specify your query time range in Interana. You might not know that Interana supports two types of relative time: precise relative time and start-of-day aligned relative time. Once you understand the difference between the two and how to leverage each of them, you'll be a pro at controlling the time range included in your query!
What's the difference between precise and start-of-day aligned relative time?
Precise relative time is calculated with respect to the exact time that you run the query. For example, if it is September 1 at 3:05 pm and I run a query that starts "1 day ago," then my query will start at exactly 1 day before the current timestamp, which is August 31 at 3:05 pm.
Start-of-day aligned relative time always starts at the beginning of the day. For example, if it is September 1 at 3:05 pm and I run a query that starts "yesterday," then my query will start at the beginning of the day yesterday, which is August 31 at 12:00 am. Start-of-day aligned relative time always captures the whole day.
How do I specify which type of relative time to use?
It all comes down to the grammar you use to specify the the query time range. Here's a chart that shows you the phrases to use to access common time ranges in precise and start-of-day aligned relative time:
|1 day ago||yesterday|
|1 week ago||last week|
|10 days ago||last 10 days|
|1 month ago||last month|
|1 year ago||last year|
Can I mix precise and start-of-day aligned relative time?
Be careful! Most of the time, your start and end times should both use the same type of relative time. You might get unexpected results if you mix relative time modes.
For example, consider the following four query time ranges: "yesterday to today," "1 day ago to now," "yesterday to now," and "1 day ago to today."
1 day ago to now: This query goes from 24 hours before the current time to the current time. It also covers 24 hours of data. Awesome!
Yesterday to today: This query goes from the start-of-day yesterday to the start-of-day today. It covers 24 hours of data. Cool!
Yesterday to now: This query goes from the start-of-day yesterday to the current time. It covers more than 24 hours of data. Yikes!
1 day ago to today: This query goes from 24 hours before the current time to the start-of-day today. Unless it is currently exactly midnight, it covers less than 24 hours of data. Oh no!
If you really know what you're doing, mixing precise and start-of-day aligned relative time can give you a lot of power to define complex time ranges. Most of the time, though, it's better to stay on the safe side and use the same type of relative time for your query start and end times.
How do I know which type of relative time I should use?
Once you understand the two different types of relative time, it's up to you to decide which is more appropriate for your query. Here are a couple of examples:
- Many Interana users like to use the automatically-generated time columns to look at how their data changes day over day or week over week. A common way to do this is to create a table view that shows event counts grouped by day. If you want to compare daily event counts then it's important to capture the full 24 hours of data for each day, because it doesn't make sense to compare an event count over 24 hours to an event count over less than 24 hours. In this case, you should should use start-of-day aligned time to make sure you always capture the full 24 hours for each day.
- Sometimes you're really interested in your most recent data. Maybe you recently pushed a new feature and you want the most up-to-date information about some metric. In order to capture the most recent 24 hours in your query, you should use precise-aligned relative time ("1 day ago to now").
If you're looking for more information, see the Time query syntax reference for detailed descriptions of the query syntax.