Splunk Search

Using time interval duration within a search

cphair
Builder

I have the feeling this should be easy, but I can't figure it out. I want to determine a host's percent uptime over an arbitrary time interval. The hosts have a particular counter they send every sixty seconds if they're up, so I can search:


index=foo counter=bar | bin _time span=1m | stats dc(_time) by host

to get a count of minutes during which each host was reporting. What I can't figure out is how to pass the time interval (or its duration) into the search itself--e.g. if I'm searching over a 24-hour period, I need the search to know that the maximum expected count of minutes is 1440. My current hack is to do a subsearch for the earliest and latest times anything reported to the server, but it's slow and it might not accurately reflect the search interval if no host is sending data. Is it possible to reference the time span within the search?

Tags (3)
0 Karma
1 Solution

Ayn
Legend

Use the addinfo command. It will create the fields containing epoch values for info_min_time (the lower timebound for the search, or 0 if no lower timebound exists), info_max_time (the upper timebound for the search, or current time if no upper timebound exists), and info_search_time (when the search was issued). So you could do something like:

... | addinfo | eval searchinterval=info_max_time-info_min_time | ...

View solution in original post

Ayn
Legend

Use the addinfo command. It will create the fields containing epoch values for info_min_time (the lower timebound for the search, or 0 if no lower timebound exists), info_max_time (the upper timebound for the search, or current time if no upper timebound exists), and info_search_time (when the search was issued). So you could do something like:

... | addinfo | eval searchinterval=info_max_time-info_min_time | ...

cphair
Builder

Bingo. Thanks.

For posterity, I had to change my stats command to avoid summarizing away the interval field:


... | stats dc(_time) as Up, values(interval) as interval by host | ...

0 Karma

ak
Path Finder

how about


stats max(_time) as end min(_time) as start | eval rangeInSeconds=(end-start)

0 Karma

cphair
Builder

That's what I'm already doing in my subsearch. I was looking for a way to avoid the extra calculation.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...