I have a scheduled report that returns the busiest hour over the last 7 days. I then manually run a report on the response times during that peak hour. In an effort to automate my task, I tried combining the searches with a subsearch, but the dataset is too large and I get the wrong busiest hour. I'd like to use loadjob of the original report to supply the earliest and latest values for the search into the second scheduled report. the first report: index=a, source=b |bin span=1h _time |convert timeformat="%Y-%m-%d:%H" ctime(_time) AS Date |stats count as ops values(_time) as time by Date |sort -ops |stats first(time) as highhour |eval earliest=highhour |eval latest=relative_time(highhour,"+3599s") |fields earliest,latest |format "(" "(" "" ")" "" ")" returns: earliest latest search ( ( earliest="1531321200" latest="1531324799.000000" ) ) I've tried: | loadjob "jobname" |join search [search index=a source=b |stats avg(responsetimes) Any suggestions on how to get them to agree with each other? ... View more