Now: 7/12/19 10:30:00.000 AM
I need search first case in interval of time 7/8/19 00:00:00.000 AM - 7/9/19 00:00:00.000 AM
The second case in interval of time 7/1/19 00:00:00.000 AM - 7/2/19 00:00:00.000 AM
How it's possible ?
With search parameter earliest and latest it's impossible,
index=en_amp_api earliest=@w1 latest=@w2
because the search work only on first case.
I try something this to do earliest and latest as variables:
To program your search to do the last 2 FULL weeks, just do this:
... earliest=-2w@w latest=@w
Also be aware that you can chain together pairs like this:
... ((earliest=e1 latest=l1) OR ... OR (earliest=eN latest=lN) ...
If you need something else, then you need to be more clear and provide MUCH more detail because it is very unclear what you need with the small amount of detail that you have given. It is always best to show some sample events and then a mockup of your desired final outcome.