How to use time range fields from subsearch used for main search?

[bt149]

I have a subsearch that is used to pull user, and start and expiration time fields.  I want to use the two time fields from the sub search to be the time frame the outter search uses to pull events.

I'm not familiar with how to do this.

earliest=<ealiest_from_subsearch> latest=<latest_from_subsearch index=myindex sourcetype=my_st_2 <my spl>
| join user
[
search index=myindex sourcetype=my_st <my spl>
| eval earliest = strptime(StartTime, "%Y-%m-%dT%H:%M:%S.%N") -18000, latest = strptime(ExpirationTime, "%Y-%m-%dT%H:%M:%S.%N") -18000
| fields user earliest latest user_role
]
table user role failure_code failure_reason

Thanks for the help and guidance.

[richgalloway]

The query uses a different type of subsearch than the question asks about.  A subsearch used in a join command does not return fields to the main search.  Instead, the results of the subsearch become new columns to the main search results.

The general form for returning earliest and latest times from a subsearch is like this

index=myindex sourcetype=my_st_2 [ search index=myindex sourcetype=my_st <my spl>
  | eval earliest = strptime(StartTime, "%Y-%m-%dT%H:%M:%S.%N") -18000, latest = strptime(ExpirationTime, "%Y-%m-%dT%H:%M:%S.%N") -18000 ]
<my spl>

[bt149]

Thanks for the input.  Here's the issue I'm seeing, after messing around a bit this morning.  I'm passing the "earliest" and "latest" fields to the outer or main search just fine and able to have the outer search search the time frame I'm looking for., when I don't include the "role" field. 

When I include the "role" field, which I need to pass the outer search and display in the main results, the total search fails.  The "role" field doesn't exist in the sourcetype that is being called in the outer search and I believe that is why my search returns no results.

[richgalloway]

Yup. Including a field that doesn't exist in the data is a good way to get zero results.  🙂

Needing to save a subsearch field for later is why we turn to  the append or join commands, but that won't help you in this case.

I see two options:

1) Run the subsearch again as part of the main query to fetch the role field.

2) Have the subsearch save its results in a lookup file that is read back later in the query.