topic Re: How can I refer to the chosen timescale within my search? in Splunk Search

How can I refer to the chosen timescale within my search?

seanel — Fri, 15 May 2015 08:48:59 GMT

To work around another issue with reporting average counts by time (See here ) I would like to instead use the chosen timespan of the search in an eval.

For instance I might have earliest=-7d latest=now and then do an eval to calculate that there is 10080 minutes in this particular search (which will enable me to do accurate averages per minute instead of the skewed results I get in the link above.

I have tried things like eval mins=earliest-latest/60 and eval mins=earliestTime-latestTime/60 but nothing seems to work

Re: How can I refer to the chosen timescale within my search?

martin_mueller — Fri, 15 May 2015 09:35:18 GMT

Add the addinfo command to your search, it'll give you fields info_min_time and info_max_time with the epoch timestamps of your time range.

http://docs.splunk.com/Documentation/Splunk/6.2.3/SearchReference/addinfo

Re: How can I refer to the chosen timescale within my search?

seanel — Fri, 15 May 2015 11:04:08 GMT

haha - figured the same thing out and was coming back to answer my own question 🙂 Many thanks!

So to solve my problem I have added |addinfo | eval totalmins=(info_max_time-info_min_time)/60 and have all I need to work around the issue in the linked post 🙂