Hi all,
I am trying to use the boundaries of the time range picker in my dashboard to calculate a value in my search query. let me explain my situation:
I am calculating on / off durations for different pieces of equipment. I receive messages when there is a change in state so each row in the table is a change of state. To calculate the duration I use delta on time to get the difference in time. See a results table example below:
Search time range: 11:00 am - 1:00pm, _time is in descending order by equipment
Where I run into an issue is when the equipment changes. A delta between the last fan event and the first heater event would generate a duration that does not make sense. This is where the time range picker range comes in. I want the duration for the highlighted event to be the time of the event to the latest boundary of the time range picker. Like below:
| eval duration = if(equipchange=NO, duration, $time_token.latest$ - duration)
I'm not sure if this is possible since I have no been able to get it to work. Any suggestions would be greatly appreciated! Let me know if I can offer more clarification.
use info_max_time
of addinfo
that is exactly what I needed, thank you to4kawa! Here is what I wrote using this solution.
| addinfo
| eval duration = if(equipchange=NO, duration, info_max_time - _time)
@aaloisi please accept the answer if your issue is resolved!