Is it possible to retrieve the timerange (earliest and latest) in a search to use as a value for eval later?

[Olli1919]

Hi fellow splunkies,

Do you know if it is possible to retrieve the timerange from the search (earliest and latest) to reuse them as fields in the search later?

I.e. like time() or now():

| inputlookup my_static_list| eval mysearch_starttime=earliest() | search my_static_list_timestampstart>mysearch_starttime

The reason behind this: I am feeding a static list which also contains a timeframe for each entry. The entry is only valid for this timeframe. The static list inputlookup is used in a subsearch to filter the outer search. So depending on when the outer search (which is scheduled) runs, only a subset of the inputlookup should be pulled. Basically a check is needed, if the two sliding timeframes (of inputlookup entries and outer search timeframe) overlap.

Thanks for you help.

[kurdbahr · Accepted solution]

Did you check the addinfo command?

[Olli1919]

Bombastic. That is the one. Thank you very much.