topic Re: Is it possible to retrieve the timerange (earliest and latest) in a search to use as a value for eval later? in Splunk Search https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-retrieve-the-timerange-earliest-and-latest-in/m-p/201725#M58457 <P>Bombastic. That is the one. Thank you very much.</P> Thu, 11 Feb 2016 17:35:07 GMT Olli1919 2016-02-11T17:35:07Z Is it possible to retrieve the timerange (earliest and latest) in a search to use as a value for eval later? https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-retrieve-the-timerange-earliest-and-latest-in/m-p/201723#M58455 <P>Hi fellow splunkies,</P> <P>Do you know if it is possible to retrieve the timerange from the search (earliest and latest) to reuse them as fields in the search later?</P> <P>I.e. like time() or now():</P> <PRE><CODE>| inputlookup my_static_list| eval mysearch_starttime=earliest() | search my_static_list_timestampstart&gt;mysearch_starttime </CODE></PRE> <P>The reason behind this: I am feeding a static list which also contains a timeframe for each entry. The entry is only valid for this timeframe. The static list inputlookup is used in a subsearch to filter the outer search. So depending on when the outer search (which is scheduled) runs, only a subset of the inputlookup should be pulled. Basically a check is needed, if the two sliding timeframes (of inputlookup entries and outer search timeframe) overlap.</P> <P>Thanks for you help.</P> Thu, 11 Feb 2016 17:06:10 GMT https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-retrieve-the-timerange-earliest-and-latest-in/m-p/201723#M58455 Olli1919 2016-02-11T17:06:10Z Re: Is it possible to retrieve the timerange (earliest and latest) in a search to use as a value for eval later? https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-retrieve-the-timerange-earliest-and-latest-in/m-p/201724#M58456 <P>Did you check the <A href="http://docs.splunk.com/Documentation/Splunk/6.3.3/SearchReference/Addinfo">addinfo</A> command?</P> Thu, 11 Feb 2016 17:22:12 GMT https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-retrieve-the-timerange-earliest-and-latest-in/m-p/201724#M58456 kurdbahr 2016-02-11T17:22:12Z Re: Is it possible to retrieve the timerange (earliest and latest) in a search to use as a value for eval later? https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-retrieve-the-timerange-earliest-and-latest-in/m-p/201725#M58457 <P>Bombastic. That is the one. Thank you very much.</P> Thu, 11 Feb 2016 17:35:07 GMT https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-retrieve-the-timerange-earliest-and-latest-in/m-p/201725#M58457 Olli1919 2016-02-11T17:35:07Z