How to pass values from main search to appended subsearch

[rain979]

I have this search:

index=xxx sourcetype="yyy" earliest=01/27/2020:08:00:00 latest=01/27/2020:18:00:00 
| timechart p99(ResponseTime) as 99p 
| sort -99p 
| head 1 
| addinfo 
| eval earliest1=strftime(relative_time(info_min_time,"+1d") ,"%Y-%m-%d %H:%M:%S") 
| eval latest1=strftime(relative_time(info_max_time,"+1d") ,"%Y-%m-%d %H:%M:%S") 
| table _time 99p 
| append 
    [ search index=xxx sourcetype="yyy" earliest=$earliest1$ latest=$latest1$
    | timechart p99(ResponseTime) as 99p 
    | sort -99p 
    | head 1 
    | table _time 99p]

How can I pass "earliest1" and "latest1" values from main search to second subsearch? is it possible?

[rain979]

Thank you very much for the answer, but I 'dont undestrand results.

If I search for earliest=01/27/2020:08:00:00 latest=01/27/2020:18:00:00 (1 day) result is:
_time | pp99 | day |maxp99
2020-01-27 13:30:00 | 17.000 1580079600.000000 | 17.000
2020-01-27 15:40:00 | 17.000 1580079600.000000 | 17.000

If I search for earliest=01/28/2020:08:00:00 latest=01/28/2020:18:00:00 (1 day) result is:
_time | pp99 |day |maxp99
2020-01-28 13:30:00 |5.500 |1580166000.000000 |5.500

If I search for earliest=01/27/2020:08:00:00 latest=01/28/2020:18:00:00 (2 days) result is:
_time | pp99 | day | maxp99
2020-01-27 15:30:00 | 16.000 |1580079600.000000 |16.000
2020-01-28 13:30:00 | 5.000 |1580166000.000000 |5.000

If range is widest earliest=01/27/2020:08:00:00 latest=01/29/2020:18:00:00 result is still different:
_time |pp99 |day |maxp99
2020-01-27 15:00 |7.000 |1580079600.000000 |7.000
2020-01-28 10:00 |4.000 |1580166000.000000 |4.000
2020-01-28 11:00 |4.000 |1580166000.000000 |4.000
2020-01-28 13:00 |4.000 |1580166000.000000 |4.000
2020-01-29 10:00 |6.300 |1580252400.000000 |6.300

The single day search produces the result I expect. What happens when I use wider ranges?
Thanks in advance.

[DalJeanis]

You want the highest value of 99p for each of the two ten hour periods.

Instead of trying what you are doing, just get all the data you want, separate them by day, and then keep the ones you want.

index=xxx sourcetype="yyy" earliest=01/27/2020:08:00:00 latest=01/28/2020:18:00:00

| rename COMMENT as "drop all events not in the desired time frames"
| eval hour=strftime(_time,"%H:%M")
| where hour>="08:00" AND hour<="18:00"

| rename COMMENT as "do timechart across both days"
| timechart  p99(ResponseTime) as 99p

| rename COMMENT as "differentiate the two days from each other"
| eval day=relative_time(_time,"@d")
| eventstats max(p99) as maxp99 by day

| rename COMMENT as "drop all records that aren't the max for the day"
| where p99=maxp99

By the way, you should set the span for your timechart, rather than letting it default.

[skoelpin]

Whats the purpose of using appendpipe? You should do it all in a single search