I am trying to compare two different results using subsearch. Both searches are using tstats. I am wanting the tstats inside the subsearch to search for -1h@h before whatever time is set in the time range picker. I saw other posts about using eval and tokens, but since tstats has to be at the beginning of the search string, and the time modifier is located withing the WHERE section, how can i handle the second time range? | tstats count from datamodel=blah WHERE earliest=fromTimePicker.Earliest latest=fromTimePicker.Latest blah1, blah2, etc.... | search NOT [ | tstats count from datamodel=blah WHERE fromTimePicker.Earliest.value-2h latest=fromTimePicker.Earliest.value blah1, blah2, etc.... ... View more

Is there a limitation on the number of search boolean clauses (i.e. OR, AND) within a search string? For example | search 'user1' OR 'user2' OR 'user3' OR ... 'user180' It seems like the color of OR changes from orange to black after a certain number. (I know need to figure out a way to shorten string due to blah, blah..) ... View more