I want to replace the time to a variable in the below query.Plz Help

[veerendra_modi]

| lookup error_rules_latest.csv EventType OUTPUT alert_type wait_time reoccurrence_window threshold_count reoccurrence_window_limit 
| transaction Id Message maxspan=5m | bucket _time span=240m 
| stats list(Timestamp) AS EventTimeStamp list(sourcetype) AS SourceOfData list(EventType) AS EventType first(wait_time) as WaitTimeLimit first(threshold_count) AS ReoccurenceThresholdCount first(reoccurrence_window_limit) count by Id Message _time 

---

The 240m and 5m needs to be taken from the lookup file as a variable.
bucket _time span=240m should be taken from reoccurrence_window_limit
maxspan=5m should be taken from wait_time

Any help will be appreciated...Thanks

[richgalloway]

Try subsearches.

| lookup error_rules_latest.csv EventType OUTPUT alert_type reoccurrence_window threshold_count 
| transaction Id Message maxspan=[| lookup error_rules_latest.csv EventType OUTPUT wait_time | return wait_time]
| bucket _time span=[| lookup error_rules_latest.csv EventType OUTPUT reoccurrence_window_limit | return reoccurrence_window_limit ]
| stats list(Timestamp) AS EventTimeStamp list(sourcetype) AS SourceOfData list(EventType) AS EventType first(wait_time) as WaitTimeLimit first(threshold_count) AS ReoccurenceThresholdCount first(reoccurrence_window_limit) count by Id Message _time 

[veerendra_modi]

Hi Rich,

Thanks for your help i tried implementing the same
=[|| lookup error_rules_latest.csv EventType OUTPUT reoccurrence_window_limit | return reoccurrence_window_limit ]

1st the double pipe sign in front is giving error so one pipeline is working.
2nd the bucket _time sapn is working but for maxspan its still not working. The results are not the same with dynamic values.
Why this discrepancy can you help.

Thanks

[richgalloway]

Thanks for pointing out the unintentional double pipes. I've corrected them.
To find out why bucket _time span isn't working with a subsearch, try running the subsearch by itself and examine the results. It should produce a string that is a valid span setting. If it does not, adjust the subsearch until it does produce a valid value.

[veerendra_modi]

I Have tried running it separately but no luck the returned value is say "240m" and while entering the hardcoded value we enter 240m without quotes. Is this the problem or something else.

Thanks a lot for your help 🙂

[richgalloway]

Yes, quotation marks will be a problem. Modify the subsearch to remove them.