I have a search that use transaction command and calculate duration of a transaction , I want to perform calculation on this duration data to find out number of minutes missed due to service outage.
Is there a way to find out what was time duration selected for a particular search so it can be used in eval function ?
index= public60 eventtype=alarm_notify | rex field=_raw "severity>(?<severity>.*)</severity.*kpiname>(?<kpi>.*) Bandwidth.*</kpiname.*target>(?<interface>.*)</target.*targetparent>(?<device>.*)</target.*Bandwidth in over (?<bandwidth>.*%) " | search kpi = wanIf OR lanIf | eval device_interface = device." - ".interface | transaction startswith=critical endswith=normal | eval available_percentage = (86400-duration)/86400*100
You can append this to your search
... | addinfo | eval search_time_duration = info_max_time - info_min_time
and do your maths after that.
You can append this to your search
... | addinfo | eval search_time_duration = info_max_time - info_min_time
and do your maths after that.
Not really, you do get the correct time range bounds. For example, when I run this over "Previous month" I expect to have my earliest event around 30 days ago, so the start of the time range is going to be much earlier:
index=_internal | stats earliest(_time) as earliesttime latest(_time) as latesttime | addinfo | foreach *time [eval <<FIELD>> = strftime(<<FIELD>>, "%F %G")]
Here's what I get as a result:
earliesttime latesttime info_max_time info_min_time
2014-06-24 09:08:10 2014-06-30 15:49:01 2014-07-01 00:00:00 2014-06-01 00:00:00
Thanks for quick response, one interesting to note is that duration is never a perfect time period . It seems like instead of search time frame what you end up getting is time difference between earliest and latest search result.