Can I use search on lookupfields for earliestTime instead of hardcoding them?

[manish31383]

Hi

I want to use lookupfield search to extract value for earliesTime and latestTime. Can I use as in example below?

source="dbmon-tail://ABC" FIELD1= $field1$ | timechart max(TOTAL_DELAY_IN_SECONDS)

| inputlookup REGION-TIME | search Field1= $field1$ | fields LIVE_START_TIME

now



line

gaps
default
false
right
log
all

[alacercogitatus]

<earliestTime> is a Splunk time format, so a search cannot be used. However, you could the lookup in the searchString of the chart as a subsearch which restricts the main search.

source="dbmon-tail://ABC" FIELD1=$field1$ [|inputlookup REGION-TIME| search Field1=$field1$ | fields LIVE_START_TIME | rename LIVE_START_TIME as earliest] | timechart max(TOTAL_DELAY_IN_SECONDS)

http://docs.splunk.com/Documentation/Splunk/5.0.5/Viz/PanelreferenceforSimplifiedXML