I'm using summary index to capture all previous days and regular index to capture today's data to improve performance. I'm taking the earliest & latest timestamp of regular index.. Timerange token is added.
Now i want to set a token for SIearliest & SILatest using regular index timestamp.
eg: if searching for last 7days, instead of "+6days" i need a variable which should automatically check and change when i search for last 30days next time.
|eval SIEarliest = $time_range$ (earliesttimestamp) +)
|eval SILatest = $time_range$ + )
my search:
index=regular sourcetype=ABC
| chart earliest(_time) as RIEarliest latest(_time) as RILatest
|eval SIEarliest = $time_range$ + relative_time(now(),"-6d@d")
|eval SILatest = $time_range$ + relative_time(now(),"-d@d")
| appendpipe [ stats count | eval EarliestTime=0 | eval LatestTime= 0 | where count=0 | table RIEarliest RILatest SIEarliest SILatest ]
