Splunk Search

Get timerange which define by user

katalinali
Path Finder

I would like to calculate the availability(i.e. duration/total time * 100) of device. I get the uptime time duration by command transaction but as the total time is set by user dynamically. Is there any way I can get the timerange defined by user when he summit search request?

Tags (1)
1 Solution

sideview
SplunkTrust
SplunkTrust

If you pipe to the 'addinfo' command it will add some fields that are about the search. In particular it will add earliest and latest time as two new fields , info_min_time and info_max_time. The difference of these two fields will be your total duration (ie | addinfo | eval total_duration=info_max_time - info_min_time)

See the answers and discussion on this question : http://answers.splunk.com/questions/2712/line-chart-comparing-yesterdays-result-with-todays-result-i...

View solution in original post

sideview
SplunkTrust
SplunkTrust

If you pipe to the 'addinfo' command it will add some fields that are about the search. In particular it will add earliest and latest time as two new fields , info_min_time and info_max_time. The difference of these two fields will be your total duration (ie | addinfo | eval total_duration=info_max_time - info_min_time)

See the answers and discussion on this question : http://answers.splunk.com/questions/2712/line-chart-comparing-yesterdays-result-with-todays-result-i...

Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...