Having a problem substituting value for earliest in a map command

[timpgray]

I am attempting to use the ‘map’ command with a sub search. In the subsearch I am using I wish to use the value of _time for the value of ‘earliest’ in the subsearch. Here is a simplified representation of the query I am attempting to perform:

index = "yyyy" | convert timeformat="%m/%d/%Y:%H:%M:%S" ctime(_time) as RequestRecvd_earliest | map [search index = "zzzz" earliest=$RequestRecvd_earliest$]

When I run this query, I get the following error:

Invalid value "$RequestRecvd_earliest$" for time term 'earliest’

This happens if I use the values ‘earliest’ or ‘latest’. If I use some other field name such as ‘bob’, I do not get this error.

Does anyone have any idea about what is going on here?

[jonuwz · Accepted solution]

Pretty sure earliest accepts an epoch value, so all the conversion is not needed.

This returns 10 events which is correct :

* | head 10 | tail 1 | rename _time as time | map search="search * earliest=$time$"

It doesnt like $_time$ for some reason, so you have to rename it.

The above search doesn't seem to work with the [ ] notation, I always have problems with it.

[timpgray]

OK thanks for the info. I think you may have indirectly answered my question. Your observation that the subsearch notation does not work seems to be the key. If I instead use your suggested notation, it works as expected. I also noticed that the parser is very particular about the exact format – ‘search=”…”’ works while ‘search = “…”’ (notice the spaces around ‘=’) does not work. This is probably what steered me towards the subsearch notation earlier. I wonder if subsearches make sense here since technically they are run first, which would not useful in this scenario