Splunk Search

Use timepicker selection in query

Communicator

Anyone know if it is possible to use the time picker selection in a query?

I would like to use this value to calculate availability of a server in base of the time range selected.

time picker 24 so time_interval = 24 hours

server timeoffline timeinterval availability
server1 3 hours 24 hours 87,5%
server2 20 hours 24 hours 26,7%

I mean, I have the number of time downtime but I can’t calculate this metric dynamically.

Thanks!

1 Solution

Communicator

After taking some time looking for information in answers I finally found the solution.

| addinfo | eval selectionduration=strftime(infomintime,"%+") . " - " . strftime(infomax_time,"%+")

View solution in original post

Explorer

Can you please elaborate it with an example.. I am getting 'No results found' when I ran the search like: index=linux sourcetype=eif | addinfo | eval selectionduration=strftime(infomintime,"%+") . " - " . strftime(infomaxtime,"%+") | table selectionduration

Communicator

You are missing underscores in the field names. That’s the problem.

infomintime
infomaxtime

http://docs.splunk.com/Documentation/Splunk/6.1.1/SearchReference/Addinfo

Communicator

After taking some time looking for information in answers I finally found the solution.

| addinfo | eval selectionduration=strftime(infomintime,"%+") . " - " . strftime(infomax_time,"%+")

View solution in original post