https://community.splunk.com/t5/Splunk-Search/How-to-find-time-range-duration-or-value/m-p/342733#M101526 <P>In searching, I understand that I can specify the time range using one of the presets (like "Last 4 hours") or set it with SPL (e.g., <CODE>earliest=10/19/2017:0:0:0 latest=10/27/2017:0:0:0</CODE>).</P> <P>My question is different. Is there a variable that can tell me what the duration of the time range being used is? For example, if I used "Last 4 hours", I would expect this field to tell me 240 minutes, and if I used "Last 60 minutes", I would expect the field is tell me 60 minutes.</P> <P>Motivation for this question: I would like to compute the aggregate queries per second over some time range, so I could just do <CODE>stats count | eval queriesPerSecond=count/durationVar</CODE></P> Thu, 08 Mar 2018 22:34:56 GMT flow2k 2018-03-08T22:34:56Z https://community.splunk.com/t5/Splunk-Search/How-to-find-time-range-duration-or-value/m-p/342733#M101526 <P>In searching, I understand that I can specify the time range using one of the presets (like "Last 4 hours") or set it with SPL (e.g., <CODE>earliest=10/19/2017:0:0:0 latest=10/27/2017:0:0:0</CODE>).</P> <P>My question is different. Is there a variable that can tell me what the duration of the time range being used is? For example, if I used "Last 4 hours", I would expect this field to tell me 240 minutes, and if I used "Last 60 minutes", I would expect the field is tell me 60 minutes.</P> <P>Motivation for this question: I would like to compute the aggregate queries per second over some time range, so I could just do <CODE>stats count | eval queriesPerSecond=count/durationVar</CODE></P> Thu, 08 Mar 2018 22:34:56 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-time-range-duration-or-value/m-p/342733#M101526 flow2k 2018-03-08T22:34:56Z https://community.splunk.com/t5/Splunk-Search/How-to-find-time-range-duration-or-value/m-p/342734#M101527 <P>you could pipe to the <A href="https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Addinfo" target="_blank">addinfo command</A>, which will add fields for info_min_time and info_max_time to your events. And then you could do the math from there. Of course, you'd have to determine how to handle odd scenarios like "All Time"...</P> Tue, 29 Sep 2020 18:23:41 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-time-range-duration-or-value/m-p/342734#M101527 maciep 2020-09-29T18:23:41Z