Multiple time frame search with one of the time frames not utilizing brackets within a macro

Lucas_K — Wed, 30 Sep 2020 02:13:46 GMT

I have a solution that uses api called macros that prefix the time frame to the search.

ie. earliest="03/14/2019:00:00:00" latest="03/14/2019:23:59:59" my_report(sample)

I need to modify this macro to search two different datasets for two different time spans (one summary, the other near realtime raw).

The idea being that I can stitch the summary and raw together to create an up to the minute report.

Contents of my_report macro
index=old_summary_data $token1$ OR (index=new_raw_data earliest=@d latest=now $sample$)

My expanded macro becomes this

earliest="03/14/2019:00:00:00" latest="03/14/2019:23:59:59" index=old_summary_data $token1$ OR (index=new_raw_data earliest=@d latest=now $sample$)

This will fail

Error in 'litsearch' command: Unable to parse the search: Invalid time bounds in search: start=1568869200 > end=1568865600.

This is due to not having a bracket preceeding the first "earliest" as per splunk docs :
(https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/SearchTimeModifiers)

example.(earliest="1/22/2018:17:00:00" latest="1/22/2018:18:00:00") OR (earliest="1/22/2018:19:00:00" latest="1/22/2018:20:00:00")

Is there any way I can make a non-bracketed time frame and query honor the

earliest="03/14/2019:00:00:00" latest="03/14/2019:23:59:59" index=old_summary_data $token1$ OR (index=new_raw_data earliest=@d latest=now $sample$)

topic Multiple time frame search with one of the time frames not utilizing brackets within a macro in Knowledge Management