Splunk Search

why is addinfo not working in my search?

auntyem
Explorer

I asked a few weeks ago how to get the total duration of my search timeframe and was told to use addinfo. Got it working out but when I made my search more complex by outer-joining to a subsearch it stopped working. I've tried putting the addinfo|eval total_time=... piece both before and after the subsearch and get no results. Here is the search:

index=nagios (src_host=blah* OR blech)|dedup src_host|addinfo|eval total_time=info_max_time-info_min_time|join type=outer src_host overwrite=false [search index=nagios (src_host=blah* OR blech) HOST ALERT HARD NOT SERVICE* host=joe|sort _time, src_host|delta _time AS duration p=1|streamstats current=f last(src_host) AS prevsrc_host|where name="UP" AND src_host=prevsrc_host|stats sum(duration) AS downtime by src_host|table src_host, downtime]|eval downtime=if(isnull(downtime),0,downtime)|eval percentup=(total_time-downtime)/total_time*100|table src_host, downtime, total_time, percentup

The outer join works, the downtime calc both in and after the subsearch works, but total_time doesn't work and thus percentup also returns nothing.

Thanks!

Tags (4)
0 Karma
1 Solution

auntyem
Explorer

In the words of the great Gilda Radner "Never mind..." For testing purposes I had the search executing with a custom time range of a date to 'now', mostly because that's what it defaulted to and I was too lazy to change it. Apparently addinfo doesn't like 'now'. Once I changed it to a hard date of today's date at 00:00:00 it worked fine.

View solution in original post

0 Karma

auntyem
Explorer

In the words of the great Gilda Radner "Never mind..." For testing purposes I had the search executing with a custom time range of a date to 'now', mostly because that's what it defaulted to and I was too lazy to change it. Apparently addinfo doesn't like 'now'. Once I changed it to a hard date of today's date at 00:00:00 it worked fine.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...