topic Can we use Start/End times from a query to get duration to use it in another search query to get an average of a field in that duration ? in Splunk Search

Can we use Start/End times from a query to get duration to use it in another search query to get an average of a field in that duration ?

MSaraswat — Sun, 07 Jan 2018 15:05:24 GMT

I am able to get the Start/End times of a load test execution from a search query (by getting End time from Timestamp (field) of the log data, and subtracting the duration (field) to get Start time.
Now I want to use this Start time, End time and duration between them in another search query with a different sourcetype such that it would fetch all the data inputs falling within that time duration (between Start/End times) from another app logs - to calculate the average/count of a field.
So, please help me in achieving the desired data with the required search queries (using subsearch/joins etc.)

Re: Can we use Start/End times from a query to get duration to use it in another search query to get an average of a field in that duration ?

micahkemp — Sun, 07 Jan 2018 18:20:20 GMT

[search <your search that creates start/end fields> | rename start AS earliest, end AS latest | table earliest latest] <your new search>

As a run-anywhere example:

[| makeresults | eval start=relative_time(now(), "-10min"), end=relative_time(now(), "-5min") | rename start AS earliest, end AS latest | table earliest latest] index=_internal

Note the run-anywhere example doesn't have search in the subsearch (between the []). This is because makeresults is a generating command. I'm assuming your initial search that calculates start/end will use an indexed search, and the search command that would be assumed in your main search string must be explicitly included inside a subsearch.

Re: Can we use Start/End times from a query to get duration to use it in another search query to get an average of a field in that duration ?

gcusello — Mon, 08 Jan 2018 07:39:36 GMT

Hi MSaraswat,
try something like this

index=my_index1 sourcetype=my_sourcetype1 [ search index=my_index2 sourcetype=my_sourcetype2 | rename Timestamp AS latest | eval earliest=strptime(latest,"time_format")-duration | fields earliest latest ]
| ...

(I don't know the Timestamp field format so you have to customize it).

Bye.
Giuseppe