I have a query where I need to break up the provided time range into 2 period so I can see the delta between the periods. I am currently using this command to mark the events
eval Period=if(time > relativetime(infomaxtime, MidPointTime),"interval1","interval2")
Currently I am passing MidPointTime into my macro manually, I would like to be able to change it so that the macro can run with any specified time range, figure out the mid point and divide the events evenly. is that possible? thanks
Sure. You're already getting the
info_max_time field, which I assume you're getting from the
addinfocommand and which defines the epochtime value of the time range's end.
addinfo also gives infomintime, which is the value of the range's start.
So just take the average of infomaxtime and infomintime, ie
Here's a sample search, and for example if you run it over last 30 days, midpoint will be 15 days ago.
index=* | head 100 | addinfo | fields info* | eval midpoint=(info_max_time + info_min_time)/2 | eval midpointstr=strftime(midpoint,"%H:%M:%S %m %d %Y")
Hi, thank you that works great. One more question, how do I convert midpoint into a format so that I can compare it to _time? thanks
Well the midpoint field in my example is already an epochtime number, ie a number of seconds since 1/1/1970 GMT. time is weird because although the Splunk UI automatically makes it look like a string formatted time, it is actually also an epochtime number. You can verify this by tacking on `eval epochTime=time` and you'll see the value is just a big integer.
So, I suspect you're asking because you want to paint a marker field with eval like
| eval marker=if(_time<midpoint,"foo","bar"), in which case you're good! If for some reason you want to make both _time and midpoint into the same reliable string times, use the strftime function in eval on both.