Can I use time range tokens in an eval expression?

[aaloisi]

Hi all,

I am trying to use the boundaries of the time range picker in my dashboard to calculate a value in my search query. let me explain my situation:

I am calculating on / off durations for different pieces of equipment. I receive messages when there is a change in state so each row in the table is a change of state. To calculate the duration I use delta on time to get the difference in time. See a results table example below:

Search time range: 11:00 am - 1:00pm, _time is in descending order by equipment

Where I run into an issue is when the equipment changes. A delta between the last fan event and the first heater event would generate a duration that does not make sense. This is where the time range picker range comes in. I want the duration for the highlighted event to be the time of the event to the latest boundary of the time range picker. Like below:

| eval duration = if(equipchange=NO, duration, $time_token.latest$ - duration) 

I'm not sure if this is possible since I have no been able to get it to work. Any suggestions would be greatly appreciated! Let me know if I can offer more clarification.

[to4kawa · Accepted solution]

use info_max_time of addinfo

[aaloisi]

that is exactly what I needed, thank you to4kawa! Here is what I wrote using this solution.

| addinfo
| eval duration = if(equipchange=NO, duration, info_max_time - _time) 

[niketn]

@aaloisi please accept the answer if your issue is resolved!