Hi,
I have a dbxquery and search "|dbxquery query="SELECT max(_time) as max_time_in_db FROM MY:TABLE" connection="my_connection"| eval start_time_temp =strptime(max_time_in_db, "%Y-%m-%d %H:%M:%S.%3N")|eval start_time = relative_time(start_time_temp,"+1d@d")| eval end_time = relative_time(start_time_temp,"+2d@d")
|eval test =strftime(start_time, "%m/%d/%Y:%H:%M:%S") |eval test2 =strftime(end_time, "%m/%d/%Y:%H:%M:%S")
|search index=my_index source IN (/my_source, my_source2) env=my_environment earliest=test latest=test2
Is it possible to use the values from dbxquery in earliest and latest? If it is, what do I do wrong
thanks for your help.
