Getting hold of an eval from subsearch

[dhruv101]

Hello,

How do I do something like this in splunk?

eval base_starttime = [search index="app_event"| eval starttime = strftime(sometime, someformat) | return starttime] | (then use base_startime ....)

Basically I want to get hold of an eval in subsearch to use in my base search.
Thanks.

[HiroshiSatoh]

Try this as an example.

[search (your search)|eval earliest=_time-60 | eval latest=_time+60 | table earliest latest | format "(" "(" "" ")" "OR" ")" ] 

[dhruv101]

Could you explain your solution. I understand that singular values like count can be accessed and stored using return $count. How do we obtain list type values?