What is the best method to search for different time ranges for 4 different sourcetypes using earliest?

[Avantika07]

I'm creating a query using 4 sourcetypes and want to search across different timerange for them. 

For example:

| multisearch [search index=idx_A, sourcetype=a, earliest=-30d, latest=@d] [search index= idx_A, sourcetype=b, earliest=-24h@h] [[search index= idx_A, sourcetype=c, earliest=-24h@h] [[search index= idx_A, sourcetype=d, earliest=-24h@h]

I saw these two solutions but it didn't really helped for my case.

https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-use-earliest-twice-in-one-search/td-...

https://community.splunk.com/t5/Splunk-Search/How-to-search-for-two-source-types-each-in-different-t...

I've tried using both multisearch and join. 

Is there a way I can get entire results.

[ITWhisperer]

I am curious to know why multisearch wasn't helpful for you?

[Avantika07]

@ITWhisperer  I tried with   last 24 hours  as the range of time picker, but not getting all results. By giving last 30 days, it goes through entire data and takes a lot of time to process.

I'm confused on what should be the correct range of time picker

[ITWhisperer]

I have not tried multisearch myself, but looking at the posts you mentioned seems to imply that different time ranges should be applied to the different searches, over-riding whatever value is put in the timepicker. Having said that, I did notice that earliest/latest doesn't seem to be expanded for subsearches (you can look at the job inspector log to see this) and perhaps that is true for multi-searches too (this seems like a bug to me if I am reading the documentation correctly).

[Avantika07]

@ITWhisperer  But  time ranges specified in a subsearch should  apply to that subsearch right.

As per your explanation would the earliest/latest  won't expand with Join as well? In that case what do you suggest to use in this scenario?