Subsearch didn't work with starttimeu passed by variable of main search

[ejpulsar]

Hi, I'm trying to calculate daily time shift baseline by this query

source="MySource" | eval ReportKey="Today" |
eval d1AgoEarliest=relative_time(_time,"-1d@d")|
eval d1AgoLatest=relative_time(_time,"-0d@d")|
append [search source="MySource" starttimeu=d1AgoEarliest endtimeu=d1AgoLatest]

It retuns error
d1AgoEarliest is not a valid value for starttimeu. It is not a positive floating point number.

[kristian_kolb]

This may prove helpful.

http://docs.splunk.com/Documentation/Splunk/5.0.2/Tutorial/Useasubsearch

[Ayn]

That's because you can't pass variables from outer searches to subsearches. Subsearches run before the outer searches, so they can't receive values from the search because it hasn't run yet.