This is an ugly search, but you could try something like: | dbquery MyDatabase [| makeresults | addinfo | eval info_max_time=if(info_max_time="+Infinity", now(), info_max_time) | eval earliest=strftime(info_min_time, "%Y-%m-%d %H:%M:%S"), latest=strftime(info_max_time, "%Y-%m-%d %H:%M:%S") | eval search="\"SELECT DISTINCT TOP 10 FROM V_MyView MyDate BETWEEN ".earliest." and ".latest."\""] The subsearch creates a dummy event, adds the search info to the event ( addinfo ), calculates string representations for earliest/latest, and crafts a string for the query using those stringified dates. That query string is named search , which causes the subsearch to place the contents of the search field directly into your search, resulting in a search that looks like: | dbquery MyDatabase "SELECT DISTINCT TOP 10 FROM V_MyView MyDate BETWEEN 1970-01-01 00:00:00 and 2018-02-15 18:58:09" ... View more

So if I understood it correctly, you are scheduling this saved search to run at specific interval and store its value in lookup so that lookup used in your query instead of writing select query. If so then you can create csv lookup try this: | dbquery MyDatabase "SELECT DISTINCT TOP 10 * FROM V_MyView"|outputlookup MyLookup.csv so now your values are stored in MyLookup.csv and now you can use directly lookup like |inputlookup MyLookup.csv ... View more