Often, we can use eval(myField=someValue)) with aggregate functions like count and avg, as well as time function like per_day, to process matching events. Is there a way for eval to match all values (or equivalently, the existence) of a field? This would be useful for searches like: timechart per_second(eval(status>-9999)) I tried timechart per_second(eval(status=*)) to no avail. ... View more

In searching, I understand that I can specify the time range using one of the presets (like "Last 4 hours") or set it with SPL (e.g., earliest=10/19/2017:0:0:0 latest=10/27/2017:0:0:0 ). My question is different. Is there a variable that can tell me what the duration of the time range being used is? For example, if I used "Last 4 hours", I would expect this field to tell me 240 minutes, and if I used "Last 60 minutes", I would expect the field is tell me 60 minutes. Motivation for this question: I would like to compute the aggregate queries per second over some time range, so I could just do stats count | eval queriesPerSecond=count/durationVar ... View more

If I wanted a count of all the events in all my indices, I can just do: index=* | stats count , which just returns a single number in a single row with this value. But say I wanted to customize the stats function - say I want to add 2 to the count returned: index=* | stats count+2 is invalid. How can I customize an aggregate statistics function with simple math operations? ... View more