You do it more or less like this... sourcetype=sep:ids earliest=1441065601 "BadString" | eval epc=strptime(substr(begin_time,8,26),"%Y-%m-%d %H:%M:%S") | eval early=(epc-300) | eval late=(epc+300) | eval badIP = L_IP | table badIP,early,late | rename COMMENT as "The above search gets your various values, then you run them into the actual search like this..." | map search="search index=foo earliest=$early$ latest=$late$ L_IP=$badIP$ (the rest of your search here)" maxsearches=100 or, if L_IP doesn't exist as a field but the IP value is somewhere in the _raw as a literal... | map search="search index=foo earliest=$early$ latest=$late$ \"$badIP$\" (the rest of your search here)" maxsearches=100 ... View more