I'm creating a query using 4 sourcetypes and want to search across different timerange for them.  For example: | multisearch [search index=idx_A, sourcetype=a, earliest=-30d, latest=@d] [search index= idx_A, sourcetype=b, earliest=-24h@h] [[search index= idx_A, sourcetype=c, earliest=-24h@h] [[search index= idx_A, sourcetype=d, earliest=-24h@h] I saw these two solutions but it didn't really helped for my case. https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-use-earliest-twice-in-one-search/td-p/198386 https://community.splunk.com/t5/Splunk-Search/How-to-search-for-two-source-types-each-in-different-time-ranges/m-p/141215 I've tried using both multisearch and join.  Is there a way I can get entire results. ... View more