More than one timerange in query

[schoep]

I use the following query to find the process mstsc.exe in a subsearch. After that i want use the results from this subsearch to find events within a timeframe, which is given also from the subsearch.
Unfortunately it is not possible to define more than one timeframe in the main search, so the OR (FORMAT function) from the subsearch is not working. How can i solve that a problem?
Thanks fo help.

| tstats summariesonly=true count AS "count_useragent" from datamodel=Web where ((nodename = Web) (Web.http_user_agent=_) (Web.dest!="*cembra.ch") [ search sourcetype="digitalguardian:process" Application_Full_Name=mstsc.exe | eval earliest=_time | eval latest=_time+60 | rename user AS Web.user | fields Web.user earliest latest | FORMAT "(" "(" "" ")" "OR" ")" ]) by _time,"Web.user","Web.dest" span=1s

[gcusello]

To better understand your need: you need to use in a dashboard, at the same time, two time periods, TimeStamp and another one, it's OK?

I needed to search logs, using in the same search timestamp and indextime to know events in a time period effectively received by Splunk in that period and not after.
To do this I created two dropdowns: the first with all start_receive dates and the second with all end_receive dates.
These dates are correlated between them in this way:

• in first dropdown start_receive showed all days since latest (taken from the Time Token) to today;
• in the second dropdown end_receive showed all days from the choosed start_receive to today.

In my search I used the Time Token to manage Time period and a where condition to take only events where indextime was >= start_receive and indextime<= end_receive:

| where indextime>=start_receive AND indextime<= end_receive

All values date in my search was converted in epochtime using eval commands.

I hope I was clear because it wasn't so easy!
Bye.
Giuseppe