Passing paramaters to subsearch

[balcv]

I have a search that returns two fields, Username and Location, for a specific username.  To extend this search, I would also like to see:

a) any other usernames, in addition to the one searched for, in the same location(s).  So if the initial search returns two different locations, I would like to see the additional users for both locations;

b) if the _time value for the additional usernames are within 15minutes (+ or -) of the initial username.

Current search that returns the data for a specific Username is

(index="o365" OR index="main") (type="New-Request" OR Operation="*") Username="smith*" Campus="MainSite"
| dedup Username,Location
| fields _time,Username,type,Operation,Location,DateTime,SSID,Campus,src_ip,Client_Mac
| table Username,Location

I'm assuming I need to do a nested search, I'm just not sure how to prepare it and pass the relevant location to return the addition usernames.

[ITWhisperer]

Try using the map command documentation  The examples are close to what you are trying. You should either calculate an earliest and latest time (- and + 15 minutes) in your initial query so they can be passed into map or save _time to a new field to pass in and calculate earliest and latest in the map search