I am trying to compare two different results using subsearch. Both searches are using tstats. I am wanting the tstats inside the subsearch to search for -1h@h before whatever time is set in the time range picker. I saw other posts about using eval and tokens, but since tstats has to be at the beginning of the search string, and the time modifier is located withing the WHERE section, how can i handle the second time range?
| tstats count from datamodel=blah WHERE earliest=fromTimePicker.Earliest latest=fromTimePicker.Latest blah1, blah2, etc.... | search NOT [ | tstats count from datamodel=blah WHERE fromTimePicker.Earliest.value-2h latest=fromTimePicker.Earliest.value blah1, blah2, etc....
