How do I write a combined search query that allows me to pick a time from the first search and then use this time to look for log events in the second search that happened witthin 30 seconds of the first.
I would like to write a search query that allows me to pick a _time from the first and use it to search all the events in the second search (different sourcetype) happening within 30 seconds of the time picked.