Temporal Types
Keywords: doc-html

Next: Port Type Up: Values, Types, and Constants Previous: Patterns Contents Index
Subsections

- Temporal Constants
- Temporal Operators
  - Temporal Negation
  - Temporal Addition
  - Temporal Subtraction
  - Temporal Multiplication
  - Temporal Division
  - Temporal Relationals

#
Temporal Types

Bro supports types representing absolute and relative times with the `time` and `interval` types, respectively.

##
Temporal Constants

There is currently no way to specify an absolute time as a constant (though see the `current_time` and `network_time` functions in § ). You can specify `interval` constants, however, by appending a time unit after a numeric constant. For example,

        3.5 min

denotes 210 seconds. The different time units are `usec`, `sec`, `min`, `hr`, and `day`, representing microseconds, seconds, minutes, hours, and days, respectively. The whitespace between the numeric constant and the unit is optional, and the letter ``s'' may be added to pluralize the unit (this has no semantic effect). So the above example could also be written:

        3.5mins

or

        150 secs

##
Temporal Operators

You can apply arithmetic and relational operators to temporal values, as follows.

###
Temporal Negation

The unary `-` operator can be applied to an `interval` value to yield another `interval` value. For example,

        - 12 hr

represents ``twelve hours in the past.''

###
Temporal Addition

Adding two `interval` values yields another `interval` value. For example,

        5 sec + 2 min

yields 125 seconds. Adding a `time` value to an `interval` yields another `time` value.

###
Temporal Subtraction

Subtracting a `time` value from another `time` value yields an `interval` value, as does subtracting an `interval` value from another `interval`, while subtracting an `interval` from a `time` yields a `time`.

###
Temporal Multiplication

You can multiply an `interval` value by a numeric value to yield another `interval` value. For example,

       5 min * 6.5

yields 1,950 seconds. `time` values cannot be scaled by multiplication or division.

###
Temporal Division

You can also divide an `interval` value by a numeric value to yield another `interval` value. For example,

       5 min / 2

yields 150 seconds. Furthermore, you can divide one `interval` value by another to yield a `double`. For example,

       5 min / 30 sec

yields 10.

###
Temporal Relationals

You may compare two `time` values or two `interval` values for equality, and also for ordering, where times or intervals further in the future are considered larger than times or intervals nearer in the future, or in the past.

Next: Port Type Up: Values, Types, and Constants Previous: Patterns Contents Index