Splunk Search
Highlighted

Using time interval duration within a search

Builder

I have the feeling this should be easy, but I can't figure it out. I want to determine a host's percent uptime over an arbitrary time interval. The hosts have a particular counter they send every sixty seconds if they're up, so I can search:


index=foo counter=bar | bin time span=1m | stats dc(time) by host

to get a count of minutes during which each host was reporting. What I can't figure out is how to pass the time interval (or its duration) into the search itself--e.g. if I'm searching over a 24-hour period, I need the search to know that the maximum expected count of minutes is 1440. My current hack is to do a subsearch for the earliest and latest times anything reported to the server, but it's slow and it might not accurately reflect the search interval if no host is sending data. Is it possible to reference the time span within the search?

Tags (3)
0 Karma
Highlighted

Re: Using time interval duration within a search

Path Finder

how about


stats max(time) as end min(time) as start | eval rangeInSeconds=(end-start)

0 Karma
Highlighted

Re: Using time interval duration within a search

Builder

That's what I'm already doing in my subsearch. I was looking for a way to avoid the extra calculation.

0 Karma
Highlighted

Re: Using time interval duration within a search

Legend

Use the addinfo command. It will create the fields containing epoch values for info_min_time (the lower timebound for the search, or 0 if no lower timebound exists), info_max_time (the upper timebound for the search, or current time if no upper timebound exists), and info_search_time (when the search was issued). So you could do something like:

... | addinfo | eval searchinterval=info_max_time-info_min_time | ...

View solution in original post

Highlighted

Re: Using time interval duration within a search

Builder

Bingo. Thanks.

For posterity, I had to change my stats command to avoid summarizing away the interval field:


... | stats dc(_time) as Up, values(interval) as interval by host | ...

0 Karma