How can I refer to the chosen timescale within my search?

[seanel]

To work around another issue with reporting average counts by time (See here ) I would like to instead use the chosen timespan of the search in an eval.

For instance I might have earliest=-7d latest=now and then do an eval to calculate that there is 10080 minutes in this particular search (which will enable me to do accurate averages per minute instead of the skewed results I get in the link above.

I have tried things like eval mins=earliest-latest/60 and eval mins=earliestTime-latestTime/60 but nothing seems to work

[martin_mueller · Accepted solution]

Add the addinfo command to your search, it'll give you fields info_min_time and info_max_time with the epoch timestamps of your time range.

http://docs.splunk.com/Documentation/Splunk/6.2.3/SearchReference/addinfo

[seanel]

haha - figured the same thing out and was coming back to answer my own question 🙂 Many thanks!

So to solve my problem I have added |addinfo | eval totalmins=(info_max_time-info_min_time)/60 and have all I need to work around the issue in the linked post 🙂