Hi, I don't know if it is possible, but I would like to specify the time range of a join subsearch from a calculated value. I have a similar log record and query: Log record:   myField=abc, collectionTimeEpoch=1626358999, maxDurationInSeconds=10, items=[id=00000000-00000000-00000000-00000000#content=123,id=myId2#content=456]   The query is similar to the following:   index="..." sourcetype="..." myField=abc | sort -_time | head 1 | eval itemList=split(items,",") | mvexpand itemList | rex field=itemList "(?<id>[-\w\d]+)#content=(?<content>[-\w\d]+)" | eval start=(collectionTimeEpoch-maxDurationInSeconds) | join type=left id [search earliest=-2d@d index="..." sourcetype="..." someField=someValue ]   I would like to replace earliest=-2d@d  to something like earliest=start, but that is not working. I have also tried   | join type=left id [search earliest=[stats count | eval earliest=(collectionTimeEpoch-maxDurationInSeconds) |fields earliest ] index="..." sourcetype="..." someField=someValue ]   Could you help me with this? Thanks in advance ... View more