Can you help me with a question about a search using the loadjob command and an earliest time modifier?

[jiaqya]

i have a saved query that can show data up to 90 days.

But, when i run the search using the loadjob command, i would like to provide an option to view only 30/60/90 days data based on a users choice.

I see that i cannot use "earliest" with the loadjob command. Any ideas how to do it?

Basically, use user chosen days ( i.e -90d@d -60d@d etc ) on the loadjob savedsearch..

|loadjob savedsearch="testuser:testapp:testsavedsearch_ss" = this gives me 90 days data

i want to have an option to show only 30/60/90 days data based on user choice from a drop down.

[adonio]

| loadjob returns the result of the search you ran. you can not filter the results per-se
however, lets imagine your search is something like this:
... index=some_index sourcetype=some_sourcetype ... | stats(something) by something_else as something
you can add the _time field after your by clause and then have a search / filter after your | loadjob
... where _time > .... complete the rest and have 30 60 and 90 in a drop-down (form input) or something

hope it helps