Overriding a time range in the saved search

[osh55]

For simplicity assume I have the following saved as a report (testReport):

index=testindex host=testhost earliest=-90m latest=now

I need to create 2 bar graphs in the same chart comparing two dates.  For starters I need to be able to run the above with a time I specify overrriding the time range above.

| savedsearch "testReport" earliest="12/08/2024:00:00:00" latest="12/08/2024:23:59:00"

I have seen a few similar question here but I don't think it has  a working solution. 

[osh55]

I have saved the report using no time range. The report works getting results for  the last 60 minutes as expected.

My issue is when I query the testReport  I want to query with different earliest and latest times, so I can have two time ranges in the same chart.

Something like:

| savedsearch "testReport" earliest="12/08/2024:00:00:00" latest="12/08/2024:23:59:00" | table id, response_time| eval lineSource = "first_day"
| append
[| savedsearch "testReport" earliest="12/09/2024:00:00:00" latest="12/09/2024:23:59:00" | table id, response_time| eval lineSource = "second_day"]

[richgalloway]

The savedsearch command has a method for passing variables to the search.  That should make it possible to pass different values for earliest and latest.  See the Search Reference manual for details.

[richgalloway]

Per the Search Reference Manual,

• If you specify All Time in the time range picker, the savedsearch command uses the time range that was saved with the saved search.
• If you specify any other time in the time range picker, the time range that you specify overrides the time range that was saved with the saved search.