Refer to selected time range in query

Follow

Tyler Lovely

• June 02, 2017 00:11

Below is my query:

_sourceHost=api AND _sourcename = "/opt/dwelo/logs/cloud_api.access.log" | timeslice 1d | count_distinct(minion_id) by minion_id, _timeslice | count_distinct(_timeslice) as days_online by minion_id | round(days_online / 8 * 100) as online_percentage | fields minion_id, online_percentage | limit 10

If the user selects the time range as 3 days instead of a week (as my query assumes), how can I dynamically change the 8 I have embedded in the above query? Is there some special variable available that tells you the range of the query?

1

• Official comment

  

  Ben Newton

  • June 03, 2017 02:53

  Tyler,

  We don't have that in the search language yet. We are considering doing it, though. Go to out ideas portal to register your idea!

  http://ideas.sumologic.com

   

  Ben

  Comment actions Permalink
• 

  Latimer Luis

  • April 21, 2020 23:20
  • Edited

  Please take a look at some of the (new-ish) time operators that were released. I think this should help you with your specific use case. 

  • queryStartTime()
  • queryEndTime()
  • queryTimeRange()

  - Latimer

  0

  Comment actions Permalink

Please sign in to leave a comment.