https://community.splunk.com/t5/Splunk-Search/why-is-addinfo-not-working-in-my-search/m-p/70533#M17642 <P>I asked a few weeks ago how to get the total duration of my search timeframe and was told to use addinfo. Got it working out but when I made my search more complex by outer-joining to a subsearch it stopped working. I've tried putting the addinfo|eval total_time=... piece both before and after the subsearch and get no results. Here is the search:</P> <P>index=nagios (src_host=blah* OR blech)|dedup src_host|addinfo|eval total_time=info_max_time-info_min_time|join type=outer src_host overwrite=false [search index=nagios (src_host=blah* OR blech) HOST ALERT HARD NOT SERVICE* host=joe|sort _time, src_host|delta _time AS duration p=1|streamstats current=f last(src_host) AS prevsrc_host|where name="UP" AND src_host=prevsrc_host|stats sum(duration) AS downtime by src_host|table src_host, downtime]|eval downtime=if(isnull(downtime),0,downtime)|eval percentup=(total_time-downtime)/total_time*100|table src_host, downtime, total_time, percentup</P> <P>The outer join works, the downtime calc both in and after the subsearch works, but total_time doesn't work and thus percentup also returns nothing.</P> <P>Thanks!</P> Mon, 28 Sep 2020 12:30:11 GMT auntyem 2020-09-28T12:30:11Z https://community.splunk.com/t5/Splunk-Search/why-is-addinfo-not-working-in-my-search/m-p/70533#M17642 <P>I asked a few weeks ago how to get the total duration of my search timeframe and was told to use addinfo. Got it working out but when I made my search more complex by outer-joining to a subsearch it stopped working. I've tried putting the addinfo|eval total_time=... piece both before and after the subsearch and get no results. Here is the search:</P> <P>index=nagios (src_host=blah* OR blech)|dedup src_host|addinfo|eval total_time=info_max_time-info_min_time|join type=outer src_host overwrite=false [search index=nagios (src_host=blah* OR blech) HOST ALERT HARD NOT SERVICE* host=joe|sort _time, src_host|delta _time AS duration p=1|streamstats current=f last(src_host) AS prevsrc_host|where name="UP" AND src_host=prevsrc_host|stats sum(duration) AS downtime by src_host|table src_host, downtime]|eval downtime=if(isnull(downtime),0,downtime)|eval percentup=(total_time-downtime)/total_time*100|table src_host, downtime, total_time, percentup</P> <P>The outer join works, the downtime calc both in and after the subsearch works, but total_time doesn't work and thus percentup also returns nothing.</P> <P>Thanks!</P> Mon, 28 Sep 2020 12:30:11 GMT https://community.splunk.com/t5/Splunk-Search/why-is-addinfo-not-working-in-my-search/m-p/70533#M17642 auntyem 2020-09-28T12:30:11Z https://community.splunk.com/t5/Splunk-Search/why-is-addinfo-not-working-in-my-search/m-p/70534#M17643 <P>In the words of the great Gilda Radner "Never mind..." For testing purposes I had the search executing with a custom time range of a date to 'now', mostly because that's what it defaulted to and I was too lazy to change it. Apparently addinfo doesn't like 'now'. Once I changed it to a hard date of today's date at 00:00:00 it worked fine. </P> Tue, 25 Sep 2012 19:44:53 GMT https://community.splunk.com/t5/Splunk-Search/why-is-addinfo-not-working-in-my-search/m-p/70534#M17643 auntyem 2012-09-25T19:44:53Z