How can I get the earliest and latest values from the time range field and calculate the difference between them?

[mishaaaaaaaaaa]

Hi, Splunk comunity!

I have a dashboard with advanced time parameters in time range form where i set earliest and latest values.

How can i get earliest and latest values in my search query, calculate the difference between them and multiply to coefficient?

In the result, I want something like this:

 | eval k = (latest-earliest)*coefficient

[chrisyounger · Accepted solution]

Hi @mishaaaaaaaaaa

You can use the tokens directly in your search if you want, or alternatively you can use the the |addinfo command in your search.

Here is some info: https://docs.splunk.com/Documentation/Splunk/7.2.3/SearchReference/Addinfo

Hope this helps

[mishaaaaaaaaaa]

thanks a lot!
I solved my problem!