topic Re: Is there a way to use search time duration in search itself? in Splunk Search

Is there a way to use search time duration in search itself?

irfans — Tue, 22 Jul 2014 03:44:50 GMT

I have a search that use transaction command and calculate duration of a transaction , I want to perform calculation on this duration data to find out number of minutes missed due to service outage.

Is there a way to find out what was time duration selected for a particular search so it can be used in eval function ?

index= public60 eventtype=alarm_notify | rex field=_raw "severity>(?<severity>.*)</severity.*kpiname>(?<kpi>.*) Bandwidth.*</kpiname.*target>(?<interface>.*)</target.*targetparent>(?<device>.*)</target.*Bandwidth in over (?<bandwidth>.*%) "   | search kpi = wanIf OR lanIf  | eval device_interface = device." - ".interface | transaction startswith=critical endswith=normal | eval available_percentage = (86400-duration)/86400*100

Re: Is there a way to use search time duration in search itself?

martin_mueller — Tue, 22 Jul 2014 04:25:12 GMT

You can append this to your search

... | addinfo | eval search_time_duration = info_max_time - info_min_time

and do your maths after that.

Re: Is there a way to use search time duration in search itself?

irfans — Tue, 22 Jul 2014 19:39:51 GMT

Thanks for quick response, one interesting to note is that duration is never a perfect time period . It seems like instead of search time frame what you end up getting is time difference between earliest and latest search result.

Re: Is there a way to use search time duration in search itself?

martin_mueller — Wed, 23 Jul 2014 09:39:15 GMT

Not really, you do get the correct time range bounds. For example, when I run this over "Previous month" I expect to have my earliest event around 30 days ago, so the start of the time range is going to be much earlier:

index=_internal | stats earliest(_time) as earliesttime latest(_time) as latesttime | addinfo | foreach *time [eval <<FIELD>> = strftime(<<FIELD>>, "%F %G")]

Here's what I get as a result:

earliesttime         latesttime           info_max_time        info_min_time
2014-06-24 09:08:10  2014-06-30 15:49:01  2014-07-01 00:00:00  2014-06-01 00:00:00