How to run two searches based on timestamp?

[majeedk_nbg]

I have a dashboard showing website user journey data by reading various elements from a  log message.  Now the structure of logs has been changed in such a way I will have to change my queries to get same data elements. 

Say the logs changed on 1st February and I want to use same dashboard to be able to see data before and after the change. 

So my question is how do I use two queries, on same data source but applying first query before hardcoded time (e.g. 2023-02-01 00:00:00) and other after this time and join the records together to generate my stats. BTW, I also have a global date time picker which dictates how far back in time I perform the search   

[PaulPanther]

If the field names were just changed you could use field aliases.

 Create field aliases in Splunk Web - Splunk Documentation

[majeedk_nbg]

The log structure has been changed completely.

Before change every thing was extracted using substrings and regex etc because different pieces of information for different event types were just were just concatenated into single message.

But  now the log message has been refactored so all fields i need are already part of message in the format userId="something", email="xyz@gmail.com", and so on. irrespective of type of event, the required field are always populated with a value which is directly use. 

[ITWhisperer]

You could use conditional evaluations e.g.

| eval userid=if(isnull(userid),substr(_raw,x,y),userid)

or

| eval userid=if(_time<fixedpointintime,substr(_raw,x,y),userid)