I have been trying to complete a search whicj includes several ealiest and latest statements. I need to search between 9:30AM and 5:30PM yesterday. For instance, if today is Nov 13, 2013 then I need to set the search to the following.
blah blah ... earliest=11/12/2013:09:30:00 latest=11/12/2013:17:30:00
My search runs fine if I specify the correct value but I need to have this run as part of a dashboard without human intervention so yesterday needs to be programatically set. I sort of need a blend of relative and defined values.
earliest=-1d@d:09:30:00 latest=-1d@d:17:30:00
I was hoping perhaps to nest one or more eval statements into the earliest and latest components to get the job done but this doesn't seem to be allowed. Something like this for earliets for instance...
earliest=(eval strftime((_time - 86400), "%Y/%m/%d:09:30:00"))
I see a few questions refering to macros and tags and lookups that might help but the problem is then how do I drop the result into the earliest or latest statements in my primary search?
Any thoughts folks?
... View more