Use timepicker selection in query

[bfernandez]

Anyone know if it is possible to use the time picker selection in a query?

I would like to use this value to calculate availability of a server in base of the time range selected.

time picker 24 so time_interval = 24 hours

server time_offline time_interval availability
server1 3 hours 24 hours 87,5%
server2 20 hours 24 hours 26,7%

I mean, I have the number of time downtime but I can’t calculate this metric dynamically.

Thanks!

[viksinha]

Can you please elaborate it with an example.. I am getting 'No results found' when I ran the search like: index=linux sourcetype=eif | addinfo | eval selectionduration=strftime(infomintime,"%+") . " - " . strftime(infomaxtime,"%+") | table selectionduration

[bfernandez]

You are missing underscores in the field names. That’s the problem.

info_min_time
info_max_time

http://docs.splunk.com/Documentation/Splunk/6.1.1/SearchReference/Addinfo

[bfernandez · Accepted solution]

After taking some time looking for information in answers I finally found the solution.

| addinfo | eval selection_duration=strftime(info_min_time,"%+") . " - " . strftime(info_max_time,"%+")