Hi fellow splunkies,
Do you know if it is possible to retrieve the timerange from the search (earliest and latest) to reuse them as fields in the search later?
I.e. like time() or now():
| inputlookup my_static_list| eval mysearch_starttime=earliest() | search my_static_list_timestampstart>mysearch_starttime
The reason behind this: I am feeding a static list which also contains a timeframe for each entry. The entry is only valid for this timeframe. The static list inputlookup is used in a subsearch to filter the outer search. So depending on when the outer search (which is scheduled) runs, only a subset of the inputlookup should be pulled. Basically a check is needed, if the two sliding timeframes (of inputlookup entries and outer search timeframe) overlap.
Thanks for you help.
