why is addinfo not working in my search?

[auntyem]

I asked a few weeks ago how to get the total duration of my search timeframe and was told to use addinfo. Got it working out but when I made my search more complex by outer-joining to a subsearch it stopped working. I've tried putting the addinfo|eval total_time=... piece both before and after the subsearch and get no results. Here is the search:

index=nagios (src_host=blah* OR blech)|dedup src_host|addinfo|eval total_time=info_max_time-info_min_time|join type=outer src_host overwrite=false [search index=nagios (src_host=blah* OR blech) HOST ALERT HARD NOT SERVICE* host=joe|sort _time, src_host|delta _time AS duration p=1|streamstats current=f last(src_host) AS prevsrc_host|where name="UP" AND src_host=prevsrc_host|stats sum(duration) AS downtime by src_host|table src_host, downtime]|eval downtime=if(isnull(downtime),0,downtime)|eval percentup=(total_time-downtime)/total_time*100|table src_host, downtime, total_time, percentup

The outer join works, the downtime calc both in and after the subsearch works, but total_time doesn't work and thus percentup also returns nothing.

Thanks!

[auntyem · Accepted solution]

In the words of the great Gilda Radner "Never mind..." For testing purposes I had the search executing with a custom time range of a date to 'now', mostly because that's what it defaulted to and I was too lazy to change it. Apparently addinfo doesn't like 'now'. Once I changed it to a hard date of today's date at 00:00:00 it worked fine.