Anyone know if it is possible to use the time picker selection in a query?
I would like to use this value to calculate availability of a server in base of the time range selected.
time picker 24 so time_interval = 24 hours
server time_offline time_interval availability
server1 3 hours 24 hours 87,5%
server2 20 hours 24 hours 26,7%
I mean, I have the number of time downtime but I can’t calculate this metric dynamically.
Thanks!
After taking some time looking for information in answers I finally found the solution.
| addinfo | eval selection_duration=strftime(info_min_time,"%+") . " - " . strftime(info_max_time,"%+")
Can you please elaborate it with an example.. I am getting 'No results found' when I ran the search like: index=linux sourcetype=eif | addinfo | eval selectionduration=strftime(infomintime,"%+") . " - " . strftime(infomaxtime,"%+") | table selectionduration
You are missing underscores in the field names. That’s the problem.
info_min_time
info_max_time
http://docs.splunk.com/Documentation/Splunk/6.1.1/SearchReference/Addinfo
After taking some time looking for information in answers I finally found the solution.
| addinfo | eval selection_duration=strftime(info_min_time,"%+") . " - " . strftime(info_max_time,"%+")