I would like to calculate the availability(i.e. duration/total time * 100) of device. I get the uptime time duration by command transaction but as the total time is set by user dynamically. Is there any way I can get the timerange defined by user when he summit search request?
If you pipe to the 'addinfo' command it will add some fields that are about the search. In particular it will add earliest and latest time as two new fields , info_min_time and info_max_time. The difference of these two fields will be your total duration (ie | addinfo | eval total_duration=info_max_time - info_min_time
)
See the answers and discussion on this question : http://answers.splunk.com/questions/2712/line-chart-comparing-yesterdays-result-with-todays-result-i...
If you pipe to the 'addinfo' command it will add some fields that are about the search. In particular it will add earliest and latest time as two new fields , info_min_time and info_max_time. The difference of these two fields will be your total duration (ie | addinfo | eval total_duration=info_max_time - info_min_time
)
See the answers and discussion on this question : http://answers.splunk.com/questions/2712/line-chart-comparing-yesterdays-result-with-todays-result-i...