I am encountering difficulty running different time range for main search and sub-search at the same time, while the time string is been received (ltime) from a savesearch.
attached are the savesearch i am running, and also the report wich is run by the savesearch.
| savedsearch ltime="09/09/2017 22:00:00"
index=GroupA latest=$ltime$ earliest=$ltime$-30m [ search index=GroupB earliest=$ltime$-7d latest=$ltime$ | table IP ] | stats latest(STATE) by IP
I would like to receive the latest time from a savedsearch and base on that, calculate the earliest/last parameter for both main search and sub-search.
I would appreciate Any advice , thanks!
Modifying time tokens is a little tricky, here's a link to another Splunk answers question that has a working solution to your problem.
Hope this helps