Modify timespan of a subsearch

[Oti47]

Hi I’m trying to compare two days in my search, but not the whole day only e.g. from 00:00 till 13:30.

index="summary_dummy" earliest=@d | addinfo | stats sum(count) AS count1, max(search_now) as time1, min(info_min_time) as time2 | eval tspan=(time1-time2)/60 | eval tspan2=round(tspan)| append [search index="summary_dummy" earliest=-2@d  searchtimespanminutes=tspan| addinfo | stats sum(count) AS count2]

I tested tspan2 with isint() but still get the error “ tspan2 is not a valid value for searchtimespanminutes. It is not a positive integer.”
I think the Problem is that I didn’t pass tspan2 to my subsearch but I’ve no idea how to do that.

[sowings]

You have it the other way around. A subsearch is evaluated before the outer search, because the results of the subsearch are passed to the outer search as a filter. I'd suggest that your search ... searchtimespanminutes=tspan ... be the outer search, with the search setting tspan be the subsearch.