I have a text date stamp called ACKTime that I need to validate is between earliest=-1d@d AND latest=-0d@d. I can
... earliest=-1d@d AND latest=-0d@d | convert timeformat "%m/%d/%y %H:%M:%S" mktime(ACKTime as ack_time| ..
but now I need to recall the values of earliest and latest as epoch so I can:
...| where ealiest<= acktime AND acktime<=latest|....
Is there a way to pass the values captured in earliest and latest so they can be reused in a where clause?
Implementation of solution by @gkanapathy,
earliest=-1d@d AND latest=-0d@d | addinfo | convert timeformat "%m/%d/%y %H:%M:%S" mktime(ACK_Time) as ack_time| where earliest<= info_max_time AND ack_time>=info_min_time |...