To work around another issue with reporting average counts by time (See here ) I would like to instead use the chosen timespan of the search in an eval.
For instance I might have earliest=-7d latest=now
and then do an eval to calculate that there is 10080 minutes in this particular search (which will enable me to do accurate averages per minute instead of the skewed results I get in the link above.
I have tried things like eval mins=earliest-latest/60
and eval mins=earliestTime-latestTime/60
but nothing seems to work
Add the addinfo
command to your search, it'll give you fields info_min_time
and info_max_time
with the epoch timestamps of your time range.
http://docs.splunk.com/Documentation/Splunk/6.2.3/SearchReference/addinfo
Add the addinfo
command to your search, it'll give you fields info_min_time
and info_max_time
with the epoch timestamps of your time range.
http://docs.splunk.com/Documentation/Splunk/6.2.3/SearchReference/addinfo
haha - figured the same thing out and was coming back to answer my own question 🙂 Many thanks!
So to solve my problem I have added |addinfo | eval totalmins=(info_max_time-info_min_time)/60
and have all I need to work around the issue in the linked post 🙂