Use field value for earliest and latest

[C_Sparn]

Hello,

I have a field "first" with a value that looks like "%m/%d/%Y:%H:%M:%S". For Example 06/25/2014:0:0:0.
Now I would like to use this field value for:

search index=any earliest=first...

This gives me the exception that the string "first" is invalid for earliest.
But if I use earliest = "06/25/2014:0:0:0" it works.
How can i use the field value?
Greetings

[martin_mueller · Accepted solution]

You can pass subsearch results into earliest and latest like this:

index=_internal [stats count | eval earliest="-h@m" | fields earliest] [stats count | eval latest="now" | fields latest]

The two subsearches can be arbitrary searches that somehow compute the timerange.

[martin_mueller]

Yeah - be wary of using that in dashboards though, you'll have to escape the dollar sign using a second dollar sign.

[C_Sparn]

Hello,

thank you, that is working. But you can also use

search...earliest = [search subsearch |return $earliest]

if earliest has the right time format.
Greetings

[C_Sparn]

Hello,
I'm getting the value from a field with multiple date values like this:

|stats first(other_field) as first then I go on with
|join[search... earliest = first]

And earliest=[subsearch] is a good idea but is also not working.
Greetings

[jeremiahc4]

It would seem to me you'd need to have a function there which would replace the literal characters "first" with the value. I've not seen this done, but could you do a subsearch in brackets there? i.e. search index=any earliest=[search terms | fields first]

[martin_mueller]

Where does that field value come from?