Bro supports types representing absolute and relative times with the time and interval types, respectively.
There is currently no way to specify an absolute time as a constant
(though see the current_time and network_time functions
in §
3.5 mindenotes 210 seconds. The different time units are usec, sec, min, hr, and day, representing microseconds, seconds, minutes, hours, and days, respectively. The whitespace between the numeric constant and the unit is optional, and the letter ``s'' may be added to pluralize the unit (this has no semantic effect). So the above example could also be written:
3.5minsor
150 secs
You can apply arithmetic and relational operators to temporal values, as follows.
The unary - operator can be applied to an interval value to yield another interval value. For example,
- 12 hrrepresents ``twelve hours in the past.''
Adding two interval values yields another interval value. For example,
5 sec + 2 minyields 125 seconds. Adding a time value to an interval yields another time value.
Subtracting a time value from another time value yields an interval value, as does subtracting an interval value from another interval, while subtracting an interval from a time yields a time.
You can multiply an interval value by a numeric value to yield another interval value. For example,
5 min * 6.5yields 1,950 seconds. time values cannot be scaled by multiplication or division.
You can also divide an interval value by a numeric value to yield another interval value. For example,
5 min / 2yields 150 seconds. Furthermore, you can divide one interval value by another to yield a double. For example,
5 min / 30 secyields 10.
You may compare two time values or two interval values for equality, and also for ordering, where times or intervals further in the future are considered larger than times or intervals nearer in the future, or in the past.