Can I set the earliest and latests statements in my search using an eval statement? (any other options?)

[itgmidrange]

I have been trying to complete a search whicj includes several ealiest and latest statements. I need to search between 9:30AM and 5:30PM yesterday. For instance, if today is Nov 13, 2013 then I need to set the search to the following.

blah blah ... earliest=11/12/2013:09:30:00 latest=11/12/2013:17:30:00

My search runs fine if I specify the correct value but I need to have this run as part of a dashboard without human intervention so yesterday needs to be programatically set. I sort of need a blend of relative and defined values.

earliest=-1d@d:09:30:00 latest=-1d@d:17:30:00

I was hoping perhaps to nest one or more eval statements into the earliest and latest components to get the job done but this doesn't seem to be allowed. Something like this for earliets for instance...

earliest=(eval strftime((_time - 86400), "%Y/%m/%d:09:30:00"))

I see a few questions refering to macros and tags and lookups that might help but the problem is then how do I drop the result into the earliest or latest statements in my primary search?

Any thoughts folks?

[richgalloway · Accepted solution]

This paragraph from the Search Reference manual (http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/SearchTimeModifiers) seems most appropriate:

You can also specify offsets from the
snap-to-time or "chain" together the
time modifiers for more specific
relative time definitions. For
example, @d-2h snaps to the beginning
of today (12AM) and subtract 2 hours
from that time.

Based on that, you should be able to do something like this: '... earliest=@d-870m latest=@d-390m | ...'

[itgmidrange]

WOW! Such a fast answer. I never know I could do that.
Nice solution! Worked like a charm. Way better than what I was trying to do.
Thanks so much Rich 🙂