How to search with times from another search?

[nkuriger]

Hi. I've got a search looking for times and dates with "index=main host=web1 "/blarg=foo"| table _time" how can I use the results to to search with "index=main host=app1 blarg" during the times from the first search?

[PickleRick]

You can modify your search so that it returns pair(s) of fields called earliest and latest.

You can then use it as a subsearch which will be expanded in runtime.

For example, this will search from index A only during those periods each day that there are events in index B

index=A
  [ index=B
  | bin _time as day span=1d
  | stats earliest_time as earliest latest_time as latest by day
  | table earliest latest ]

All typical caveats regarding subsearches apply.