In my SPL JOIN query, I want to get the events for, let's say, between T1 and T2; however, the relevant events on the right side of the query happened between T1-60m and T2. I can't figure out how to do it in the dashboard or just a report. Using relative_time won't work for some reason. I appreciate any help. index=myindex
| fields a, b, c
| join type=inner left=l right=r where l.keyid=r.keyid
[search index=myindex ```<- how to change the earliest to earliest-60m?```
|fields d, f
]
| table l.a, l.b, l.c, r.d, r.f
... View more