Splunk Search

why is addinfo not working in my search?

auntyem
Explorer

I asked a few weeks ago how to get the total duration of my search timeframe and was told to use addinfo. Got it working out but when I made my search more complex by outer-joining to a subsearch it stopped working. I've tried putting the addinfo|eval total_time=... piece both before and after the subsearch and get no results. Here is the search:

index=nagios (src_host=blah* OR blech)|dedup src_host|addinfo|eval total_time=info_max_time-info_min_time|join type=outer src_host overwrite=false [search index=nagios (src_host=blah* OR blech) HOST ALERT HARD NOT SERVICE* host=joe|sort _time, src_host|delta _time AS duration p=1|streamstats current=f last(src_host) AS prevsrc_host|where name="UP" AND src_host=prevsrc_host|stats sum(duration) AS downtime by src_host|table src_host, downtime]|eval downtime=if(isnull(downtime),0,downtime)|eval percentup=(total_time-downtime)/total_time*100|table src_host, downtime, total_time, percentup

The outer join works, the downtime calc both in and after the subsearch works, but total_time doesn't work and thus percentup also returns nothing.

Thanks!

Tags (4)
0 Karma
1 Solution

auntyem
Explorer

In the words of the great Gilda Radner "Never mind..." For testing purposes I had the search executing with a custom time range of a date to 'now', mostly because that's what it defaulted to and I was too lazy to change it. Apparently addinfo doesn't like 'now'. Once I changed it to a hard date of today's date at 00:00:00 it worked fine.

View solution in original post

0 Karma

auntyem
Explorer

In the words of the great Gilda Radner "Never mind..." For testing purposes I had the search executing with a custom time range of a date to 'now', mostly because that's what it defaulted to and I was too lazy to change it. Apparently addinfo doesn't like 'now'. Once I changed it to a hard date of today's date at 00:00:00 it worked fine.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...