Refer to selected time range in query
Below is my query:
_sourceHost=api AND _sourcename = "/opt/dwelo/logs/cloud_api.access.log" | timeslice 1d | count_distinct(minion_id) by minion_id, _timeslice | count_distinct(_timeslice) as days_online by minion_id | round(days_online / 8 * 100) as online_percentage | fields minion_id, online_percentage | limit 10
If the user selects the time range as 3 days instead of a week (as my query assumes), how can I dynamically change the 8 I have embedded in the above query? Is there some special variable available that tells you the range of the query?
-
Official comment
Tyler,
We don't have that in the search language yet. We are considering doing it, though. Go to out ideas portal to register your idea!
Ben
Comment actions -
Please take a look at some of the (new-ish) time operators that were released. I think this should help you with your specific use case.
- Latimer
Please sign in to leave a comment.
Comments
2 comments