I have a first search queryA
that returns a set of events. I would like to make a second search queryB
using the earliest/latest event of queryA
as timeframe for queryB
. Then I would like merge results from both searches together. Is this even possible?
queryA | stats earliest(_time) AS Earliest, latest(_time) AS Latest
. to get the earliest/latest events in queryAqueryB | _time > Earliest AND _time < Latest
?queryA
. Is that possible without running queryA
again?You can do this
search part of queryB [ search queryA
| stats earliest(_time) as earliest latest(_time) as latest
| eval earliest=strftime(earliest,"%m/%d/%Y:%H:%M:%S")
| eval latest=strftime(latest,"%m/%d/%Y:%H:%M:%S") ]
| rest of queryB
You might want to read more About subsearches
And the community might have even better ideas if you actually showed us what is in the queries...