Get timerange which define by user

[katalinali]

I would like to calculate the availability(i.e. duration/total time * 100) of device. I get the uptime time duration by command transaction but as the total time is set by user dynamically. Is there any way I can get the timerange defined by user when he summit search request?

[sideview · Accepted solution]

If you pipe to the 'addinfo' command it will add some fields that are about the search. In particular it will add earliest and latest time as two new fields , info_min_time and info_max_time. The difference of these two fields will be your total duration (ie | addinfo | eval total_duration=info_max_time - info_min_time)

See the answers and discussion on this question : http://answers.splunk.com/questions/2712/line-chart-comparing-yesterdays-result-with-todays-result-i...