returning _time from subsearch to main search

[rmurthy]

Hi,
I want to run a subsearch, pass the host and _time to the main search. The main search will look for some other events for the host from earliest=_time (returned from subsearch) and latest=_time + x hrs.
Can you tell me how can I achieve this?

Thanks.

[dwaddle]

You can directly return earliest and latest from the subsearch, which should do what you want.

sourcetype=foo bar baz [ search sourcetype=blah 
|eval earliest=field1 
| eval latest=field1+3600 
| fields earliest, latest ]

[sowings]

Have your subsearch return terms of earliest and latest. So this might look like

[ search <subsearch> | rename \_time AS earliest | eval latest=earliest + (3600 * x) | fields earliest, latest ]
<main_search>

Where x is your number of hours. The _time field is an epoch time, hence doing math in seconds.