Splunk Search

Get timerange which define by user

katalinali
Path Finder

I would like to calculate the availability(i.e. duration/total time * 100) of device. I get the uptime time duration by command transaction but as the total time is set by user dynamically. Is there any way I can get the timerange defined by user when he summit search request?

Tags (1)
1 Solution

sideview
SplunkTrust
SplunkTrust

If you pipe to the 'addinfo' command it will add some fields that are about the search. In particular it will add earliest and latest time as two new fields , info_min_time and info_max_time. The difference of these two fields will be your total duration (ie | addinfo | eval total_duration=info_max_time - info_min_time)

See the answers and discussion on this question : http://answers.splunk.com/questions/2712/line-chart-comparing-yesterdays-result-with-todays-result-i...

View solution in original post

sideview
SplunkTrust
SplunkTrust

If you pipe to the 'addinfo' command it will add some fields that are about the search. In particular it will add earliest and latest time as two new fields , info_min_time and info_max_time. The difference of these two fields will be your total duration (ie | addinfo | eval total_duration=info_max_time - info_min_time)

See the answers and discussion on this question : http://answers.splunk.com/questions/2712/line-chart-comparing-yesterdays-result-with-todays-result-i...

Get Updates on the Splunk Community!

Demo Day: Strengthen Your SOC with Splunk Enterprise Security 8.1

Today’s threat landscape is more complex than ever. Security operation centers (SOCs) are overwhelmed with ...

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...