Measure availablity in during certain hours during the day

[JYTTEJ]

Hi I have created following search to measure availability per day (24 hours)

host=xxxxxp*   | delta _time AS timeDeltaS p=1 | eval timeDeltaS=abs(timeDeltaS) | eval timeDelta=tostring(timeDeltaS,"duration")|where timeDeltaS >15 |RENAME timeDeltaS as Sec_unavailable   |APPEND [SEARCH host=xxxxxp*  PRJ=PRJABC| eval Sec_unavailable=0 ]|bucket _time span=1d |stats  sum(Sec_unavailable)  by _time| RENAME sum(Sec_unavailable) as sec_unavail |eval avail=86400-sec_unavail|eval AvailPct = round((avail/86400)*100,2)|timechart span=1d sum(AvailPct)|RENAME sum(AvailPct) as "Avail.Pct"

This calculates availabilty % per day round((avail/86400)*100,2)

Now I want to calculate the availability within the service hours (07 to 19 GMT) per day.
I know how to select the service hours (date_hour >07 AND date_hour <19) - and I have changed the 86400 (24 hours) seconds to 46800 (=13 hours) - but I am getting negative availabilty...

I believe this is due to the *bucket _time span=1d* - but I am very most lost as to which bucket command I should use?

[Ayn]

Well without having had a closer look at your search, if your search that spans 1 day is to be changed into a search that spans 12 hours, then the bucket command should likely be changed accordingly. So: bucket _time span=12h

[JYTTEJ]

I found the reason why I was getting a negative value. this is because the search calculates the difference in time between 20:00 to 07:00 - how do I avoid that?
I only want to calculate any difference in time between 07:00 to 20:00 - how do I accomplish that?