What is the best way to join search queries in different time zones?

[nehal_shah]

What is the best way to join search queries in different time zones? I have tried following and it doesn't work. It just goes through everything and disregards the earliest and latest completely.

Query 1 | eval earliest=if(isnum("$timepicker1.earliest$"),strftime("$timepicker1.earliest$",'%m/%d/%Y:%H:%M:%S'),"$timepicker1.earliest$") | eval latest=if(isnum("$timepicker1.latest$"),strftime("$timepicker1.latest$",'%m/%d/%Y:%H:%M:%S'),"$timepicker1.latest$")  | fields earliest latest| join [search Query 2 | eval earliest=if(isnum("$timepicker2.earliest$"),strftime("$timepicker2.earliest$",'%m/%d/%Y:%H:%M:%S'),"$timepicker2.earliest$") | eval latest=if(isnum("$timepicker2.latest$"),strftime("$timepicker2.latest$",'%m/%d/%Y:%H:%M:%S'),"$timepicker2.latest$") | fields earliest latest ]

[nehal_shah · Accepted solution]

I managed to get around by using the gentimes. Look at the following link for more details.

https://answers.splunk.com/answers/454360/set-earliest-and-latest-using-a-variable-depending.html

[nehal_shah]

I see your point. Yes I am getting data from separate disjointed data ranges.

[martin_mueller]

You're adding two fields to your search results using eval, that's not going to magically filter the preceding search.

Are you trying to get data from two separate time ranges? For example, one time range picker set to "last week" and one set to "today"?