Using time interval duration within a search

[cphair]

I have the feeling this should be easy, but I can't figure it out. I want to determine a host's percent uptime over an arbitrary time interval. The hosts have a particular counter they send every sixty seconds if they're up, so I can search:

index=foo counter=bar | bin _time span=1m | stats dc(_time) by host

to get a count of minutes during which each host was reporting. What I can't figure out is how to pass the time interval (or its duration) into the search itself--e.g. if I'm searching over a 24-hour period, I need the search to know that the maximum expected count of minutes is 1440. My current hack is to do a subsearch for the earliest and latest times anything reported to the server, but it's slow and it might not accurately reflect the search interval if no host is sending data. Is it possible to reference the time span within the search?

[Ayn · Accepted solution]

Use the addinfo command. It will create the fields containing epoch values for info_min_time (the lower timebound for the search, or 0 if no lower timebound exists), info_max_time (the upper timebound for the search, or current time if no upper timebound exists), and info_search_time (when the search was issued). So you could do something like:

... | addinfo | eval searchinterval=info_max_time-info_min_time | ...

[cphair]

Bingo. Thanks.

For posterity, I had to change my stats command to avoid summarizing away the interval field:

... | stats dc(_time) as Up, values(interval) as interval by host | ...

[ak]

how about


stats max(_time) as end min(_time) as start | eval rangeInSeconds=(end-start)

[cphair]

That's what I'm already doing in my subsearch. I was looking for a way to avoid the extra calculation.