How do I do something like this in splunk?
eval base_starttime = [search index="app_event"| eval starttime = strftime(sometime, someformat) | return starttime] | (then use base_startime ....)
Basically I want to get hold of an eval in subsearch to use in my base search.
Try this as an example.
[search (your search)|eval earliest=_time-60 | eval latest=_time+60 | table earliest latest | format "(" "(" "" ")" "OR" ")" ]
Could you explain your solution. I understand that singular values like count can be accessed and stored using return $count. How do we obtain list type values?