Try this:
index="the proxy" "badness" earliest=-1d | dedup hostname | eval start = relative_time(_time, "-d")
| map maxsearches=42 search="search earliest=$start$ latest=$_time$ index=proxy proxyblock=false hostname=$hostname$"
That'll kick off a search for each returned hostname , using that event as the (non-inclusive) end of the one-day timerange.
... View more