Splunk Search

How do I get the mid point of the specified time range?

Hung_Nguyen
Path Finder

I have a query where I need to break up the provided time range into 2 period so I can see the delta between the periods. I am currently using this command to mark the events

eval Period=if(_time > relative_time(info_max_time, Mid_Point_Time),"interval_1","interval_2")

Currently I am passing Mid_Point_Time into my macro manually, I would like to be able to change it so that the macro can run with any specified time range, figure out the mid point and divide the events evenly. is that possible? thanks

Tags (3)
1 Solution

sideview
SplunkTrust
SplunkTrust

Sure. You're already getting the info_max_time field, which I assume you're getting from the addinfocommand and which defines the epochtime value of the time range's end. addinfo also gives info_min_time, which is the value of the range's start.

So just take the average of info_max_time and info_min_time, ie (info_min_time+info_max_time)/2

Here's a sample search, and for example if you run it over last 30 days, midpoint will be 15 days ago.

index=* | head 100 | addinfo | fields info* | eval midpoint=(info_max_time + info_min_time)/2 | eval midpointstr=strftime(midpoint,"%H:%M:%S %m %d %Y")

View solution in original post

sideview
SplunkTrust
SplunkTrust

Sure. You're already getting the info_max_time field, which I assume you're getting from the addinfocommand and which defines the epochtime value of the time range's end. addinfo also gives info_min_time, which is the value of the range's start.

So just take the average of info_max_time and info_min_time, ie (info_min_time+info_max_time)/2

Here's a sample search, and for example if you run it over last 30 days, midpoint will be 15 days ago.

index=* | head 100 | addinfo | fields info* | eval midpoint=(info_max_time + info_min_time)/2 | eval midpointstr=strftime(midpoint,"%H:%M:%S %m %d %Y")

Hung_Nguyen
Path Finder

Hi, thank you that works great. One more question, how do I convert midpoint into a format so that I can compare it to _time? thanks

0 Karma

sideview
SplunkTrust
SplunkTrust

Well the midpoint field in my example is already an epochtime number, ie a number of seconds since 1/1/1970 GMT. _time is weird because although the Splunk UI automatically makes it look like a string formatted time, it is actually also an epochtime number. You can verify this by tacking on eval epochTime=_time and you'll see the value is just a big integer.

So, I suspect you're asking because you want to paint a marker field with eval like | eval marker=if(_time<midpoint,"foo","bar"), in which case you're good! If for some reason you want to make both _time and midpoint into the same reliable string times, use the strftime function in eval on both.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...