Splunk Search

Use timepicker selection in query

bfernandez
Communicator

Anyone know if it is possible to use the time picker selection in a query?

I would like to use this value to calculate availability of a server in base of the time range selected.

time picker 24 so time_interval = 24 hours

server time_offline time_interval availability
server1 3 hours 24 hours 87,5%
server2 20 hours 24 hours 26,7%

I mean, I have the number of time downtime but I can’t calculate this metric dynamically.

Thanks!

1 Solution

bfernandez
Communicator

After taking some time looking for information in answers I finally found the solution.

| addinfo | eval selection_duration=strftime(info_min_time,"%+") . " - " . strftime(info_max_time,"%+")

View solution in original post

viksinha
Explorer

Can you please elaborate it with an example.. I am getting 'No results found' when I ran the search like: index=linux sourcetype=eif | addinfo | eval selectionduration=strftime(infomintime,"%+") . " - " . strftime(infomaxtime,"%+") | table selectionduration

bfernandez
Communicator

You are missing underscores in the field names. That’s the problem.

info_min_time
info_max_time

http://docs.splunk.com/Documentation/Splunk/6.1.1/SearchReference/Addinfo

bfernandez
Communicator

After taking some time looking for information in answers I finally found the solution.

| addinfo | eval selection_duration=strftime(info_min_time,"%+") . " - " . strftime(info_max_time,"%+")

Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...