I have data stored in the csv file, which contains the time field. I want the data for complete last week and also the data for current week. Eg Day1: 100 day2: 200. . . . .Day14:600 I want data from day1-day7 -> Current week and day7-14 -> Previous week I am doing something like below, but it gives me data from current week    | eval first_day_last_week=relative_time(relative_time(now(),"-1w@w"),"-1d@d"), last_day_last_week=relative_time(relative_time(now(),"-1w@w"),"+6d@d") | where _time>=first_day_last_week AND _time<=last_day_last_week   technically the data should not come up as today is the Aug 7 and it should not show as it is from current week   ... View more

I have set of records where the data has time column in it. Eg: Here I will have an input from user where user will enter the date in input box in any format (yyyy/mm/dd) I want to find all records that are greater than the time entered by user.   ... View more

I have an  ``` index=xyz data.id=1 ``` which gives me list of unique id's [1,2,3,4,5]Not sure how to store the above result to get it used for another query. | stats count by uniqueId Now I want to use the list above and get the data from another query and find the values Query 2 will return  1 -> good 2 -> Bad 3 -> Neural / etc Index2 I want to use the result [1,2,3,4] for the next query which will give me some extra information based on the ID only. Eg: Query 2 has index=xyz data.msg.id=1, data.xyz.val=good How can we do that? I am trying something like this   index="test" actionSubCateg IN (xyz) landingPageURL="xyz/?search=game_gupta" data.msg.queryName="query FindBtf" | table data.msg.id Find in second query the results of top [ search index="test" actionSubCateg="game" | rename data.DATA.id as id | fields id, scope | table id, scope]   ... View more