Hi @Thulasinathan_M , you cannot use a calculation (earliest=$_time$-3600) in a search, but you can put the values to use for your search in a lookup, with the only attention point to use the same fields, something like this: in the lookup you should put two fields: earliest and latest and the run a search like the following index=main [| inputlookup my_time_periods.csv | fields earliest latest ] user arrival
| timechart span=10m count by user limit=15
| untable _time user value
| join type=left user
[| inputlookup UserDetails.csv
| eval DateStart=strftime(relative_time(_time), "-7d@d"), "%Y-%m-%d")
| where Date > DateStart two addition infos: don't use index=main, but use your own index. don't user join for an inputlookup: the lookup command is a left join and in general use the join command only when you haven't any other solution because Splunk isn't a database and it's a very slow command! please try this: index=your_index [| inputlookup my_time_periods.csv | fields earliest latest ] user arrival
| timechart span=10m count by user limit=15
| untable _time user value
| lookup UserDetails.csv user
| eval DateStart=strftime(relative_time(_time), "-7d@d"), "%Y-%m-%d")
| where Date > DateStart Ciao. Giuseppe
... View more
