How to extract earliest and latest event of one search, use them as the time range for a second search, then merge results?

[thibaudh]

I have a first search queryA that returns a set of events. I would like to make a second search queryB using the earliest/latest event of queryA as timeframe for queryB. Then I would like merge results from both searches together. Is this even possible?

1. I know I can do queryA | stats earliest(_time) AS Earliest, latest(_time) AS Latest. to get the earliest/latest events in queryA
2. Now how do something like queryB | _time > Earliest AND _time < Latest?
3. Finally, I would like to merge the results of 2) with queryA. Is that possible without running queryA again?

[lguinn2]

You can do this

search part of queryB [ search queryA 
           | stats earliest(_time) as earliest latest(_time) as latest 
           | eval earliest=strftime(earliest,"%m/%d/%Y:%H:%M:%S")
           | eval latest=strftime(latest,"%m/%d/%Y:%H:%M:%S") ]
| rest of queryB

You might want to read more About subsearches

And the community might have even better ideas if you actually showed us what is in the queries...