Searching by Time

Searching with Time allows you search on timestamps on the data in Frame Display and Event Display window.

To access the search by time function:

1. Open a capture file to search.
2. Open the Event Display or Frame Display window.
3. Click on the Find icon or choose Find from the Edit menu.
    
4. Click on the Time tab of the Find dialog.
    

Note: The tabs displayed on the Find dialog depend on the product you are running and the content of the capture file you are viewing.

The analyzer can search by time in several different ways.

Search for Absolute/Relative timestamp.

• Absolute - An absolute timestamp search means that the analyzer searches for an event at the exact date and time specified. If no event is found at that time, the analyzer goes to the nearest event either before or after the selected time, based on the "Go to the timestamp" selection.

• Relative - A relative search means that the analyzer begins searching from whatever event you are currently on, and search for the next event a specific amount of time away.

1. Select Absolute or Relative

2. Select the date and time using the drop-down lists for Month, Year, Day, Hour, Minute, Second, 1/10000000.

   Note: Month and Year are not available if you select Relative.
   

3. When you have specified the time interval you want to use, click on the Go To, Move Forward or Move Backward buttons to start the search from the current event.

   Note: When you select Absolute as Search for, Go To is available.  When you select Relative as Search for, Move Forward or Move Backwardis available.

Go to the timestamp: On or before/ On or after

The analyzer searches for an event that matches the time specified. If no event is found at the time specified, the analyzer goes to the nearest event either before or after the specified time. Choose whether to have the analyzer go to the nearest event before the specified time or after the specified time by clicking the appropriate radio button in the Go to the timestamp box.

If you are searching forward in the buffer, you usually want to choose the On or After option. If you choose the On or Before option, it may be that the analyzer finishes the search and not move from the current byte, if that byte happens to be the closest match.
 

When you select Absolute as Search for, the radio buttons are On or before the specified time or On or after the specified time.  When you select Relative as Search for, the radio buttons are On or before the specified time relative to the first selected item or On or after  the specified time relative to the last selected item.
 

1. Select On or before the specified time or On or after the specified time.

2. When you have specified the time interval you want to use, click on the Go To, Move Forward or Move Backward buttons to start the search from the current event.

   When you select Absolute as Search for, Go To is available.  When you select Relative as Search for, Move Forward or Move Backwardis available.

There are a couple of other concepts to understand in respect to searching with timestamps.

• The analyzer skips some special events that do not have timestamps, such as frame markers. Data events that do not have timestamps because timestamping was turned off either before or during capture are also skipped.  
• Timestamping can be turned on and off while data is being captured. As a result, the capture buffer may have some data with a timestamp, and some data without. When doing a search by timestamp, the analyzer ignores all data without a timestamp.
• The raw timestamp value is the number of 100-nanosecond intervals since the beginning of January 1, 1601. This is standard Windows time.

Also see these related topics...