How do I get the mid point of the specified time range?

[Hung_Nguyen]

I have a query where I need to break up the provided time range into 2 period so I can see the delta between the periods. I am currently using this command to mark the events

eval Period=if(_time > relative_time(info_max_time, Mid_Point_Time),"interval_1","interval_2")

Currently I am passing Mid_Point_Time into my macro manually, I would like to be able to change it so that the macro can run with any specified time range, figure out the mid point and divide the events evenly. is that possible? thanks

[sideview · Accepted solution]

Sure. You're already getting the info_max_time field, which I assume you're getting from the addinfocommand and which defines the epochtime value of the time range's end. addinfo also gives info_min_time, which is the value of the range's start.

So just take the average of info_max_time and info_min_time, ie (info_min_time+info_max_time)/2

Here's a sample search, and for example if you run it over last 30 days, midpoint will be 15 days ago.

index=* | head 100 | addinfo | fields info* | eval midpoint=(info_max_time + info_min_time)/2 | eval midpointstr=strftime(midpoint,"%H:%M:%S %m %d %Y")

[Hung_Nguyen]

Hi, thank you that works great. One more question, how do I convert midpoint into a format so that I can compare it to _time? thanks

[sideview]

Well the midpoint field in my example is already an epochtime number, ie a number of seconds since 1/1/1970 GMT. _time is weird because although the Splunk UI automatically makes it look like a string formatted time, it is actually also an epochtime number. You can verify this by tacking on eval epochTime=_time and you'll see the value is just a big integer.

So, I suspect you're asking because you want to paint a marker field with eval like | eval marker=if(_time<midpoint,"foo","bar"), in which case you're good! If for some reason you want to make both _time and midpoint into the same reliable string times, use the strftime function in eval on both.