How do I write a combined search query that allows me to pick a time from the first search and then use this time to look for log events in the second search that happened witthin 30 seconds of the first.

[ahuseid]

I would like to write a search query that allows me to pick a _time from the first and use it to search all the events in the second search (different sourcetype) happening within 30 seconds of the time picked.

Thanks.

[woodcock]

You need the map command; check out the accepted answer here:

http://answers.splunk.com/answers/232781/find-all-events-of-type-x-that-do-not-have-an-even.html