I am trying to do the same thing. I'm not sure this is the best solution, but I used a subsearch to find the latest index time of the data and then used that in the main search. index=myIndex sourcetype=mySourceType report=myReport [|search index=myIndex sourcetype=mySourceType report=myReport | stats latest(_time) as earliest] ... View more

I'm having the same issue, I get no error in the search but the data is never indexed if I use a field value instead of just text. ... View more