And based on which search (inputlookup or your indexed data search) has higher number of records, that one should be run as subsearch. ... View more

Yes, the span is controlled by the span mentioned in your timechart command. If you write |timechart span=1d then when using your future_timespan="182" . It means that the future time span is 182 days. If you chose your timechart span to be 1 hour, the future_timespan would showcase 182 hours. etc ... View more