How do I get the job-execution start time and job execution endtime of my query as output of the query.
index = some_index source = somesoure
| some_logic added here
| eval search_starttime = $job.earliestTime$
| eval search_endtime = $job.latestTime$
| table some_logic_output search_starttime search_endtime
I am seeing no result for the search_starttime and search_endtime column in my table.
Any help ?
What I mean here is, how do I get the _time value for the earliest event and the _time value of my latest event of my search resultset ?
Try addinfo.
index = some_index source = somesoure
| some_logic added here
| addinfo
| eval search_starttime = info_min_time
| eval search_endtime = info_max_time
| table some_logic_output search_starttime search_endtime
@richgalloway It gives me search_starttime as 0 and search_endtime as+infinity. 😞
Sorry , for the confusion.
But what I meant is, how do I get the _time value for the earliest event and the _time value of my latest event of my search result.
Thanks @isoutamo
But my problem is if I use stats then that value isn't get dynamically passed to the macro.
search index = index_name source = source_name
| fields + bio, _time
| stats earliest_time(_time) as eTime latest_time(_time) as lTime
| eval Proj_Name = "my big project"
| `my_Macro(Proj_name, eTime, lTime)`
|table proj_value , proj_date
In the above case the macro doesn't get invoked.
However if I change something like below then the macro works and I get the desired result.
search index = index_name source = source_name
| fields + bio, _time
| eval eTime=6735475120.999
|eval lTime=6542213344.976
| eval Proj_Name = "my big project"
| `my_Macro(Proj_name, eTime, lTime)`
|table proj_value , proj_date
It works with eval statement But I cannot hard-code the earliest and latest time. It has to to be dynamic based on the latest_event time and earliest event time. In the macro eTime and lTime values gets passed as earliest and latest values of a dashboard URL, and the Macro outputs that URL along with few other values.
The eventstats command is what you're looking for. Please try:
search index = index_name source = source_name
| fields + bio, _time
| eventstats earliest_time(_time) as eTime latest_time(_time) as lTime
| eval Proj_Name = "my big project"
| `my_Macro(Proj_name, eTime, lTime)`
| table proj_value , proj_date