how about using map to give a time frame for each field-value pair?
| eval time_b4=relative_time(time_anchor, "-1h") | eval time_l8r=relative_time(time_anchor, "+1h") | map search="search index=index1 sourcetype=sourcetype1 field1=$field$ earliest=$time_b4$ latest=$time_l8r$"
Something like that maybe?
... View more