Hi, I'm trying to calculate daily time shift baseline by this query
source="MySource" | eval ReportKey="Today" |
eval d1AgoEarliest=relative_time(_time,"-1d@d")|
eval d1AgoLatest=relative_time(_time,"-0d@d")|
append [search source="MySource" starttimeu=d1AgoEarliest endtimeu=d1AgoLatest]
It retuns error
d1AgoEarliest is not a valid value for starttimeu. It is not a positive floating point number.
This may prove helpful.
http://docs.splunk.com/Documentation/Splunk/5.0.2/Tutorial/Useasubsearch
That's because you can't pass variables from outer searches to subsearches. Subsearches run before the outer searches, so they can't receive values from the search because it hasn't run yet.