First, fix your basic search like this:
| metadata my indexexes type=hosts
| rename totalCount as Count, host as SplunkHost, lastTime as "Last Event"
| eval actualhourslag=(now()-'Last Event')/60/60
| eval which="metadata"
| inputlookup append=t perimeter.csv
| eval which=coalesce(which, "csv")
| eval SplunkHost=lower(SplunkHost)
| stats values(*) AS * BY SplunkHost
| where actualhourslag>HoursLag OR NOT actualhourslag="*"
| stats sum(Count) by SplunkHost
| rename sum(Count) as total
| where total < 50
| fieldformat "Last Event"=strftime('Last Event', "%c")
Now I am not sure what you mean about the timeframe stuff but perhaps add something like this:
| bin timeframe span=6
| stats <some stuff here> BY timeframe
... View more