How to write this type of return query?

[tchintam]

My query is:

search[|inputlookup abc | stats count(Numbers) as sum| eval end=strptime(End_Date_Time,"%Y/%m/%d %H:%M:%S") , start=strptime(Start_Date_Time,"%Y/%m/%d %H:%M:%S")
| eval time=(_time>"+start+" AND _time<"+end+")
| return 2 $time
| rex mode=sed field=search "s/OR/AND/g"
| return $search]

My doubt is how to pass the sum in place of 2? (I'm passing 2 since there are 2 rows)

[DalJeanis]

So, first of all, when you use a stats command, anything not listed in the command is GONE. There is no Start_Date_Time or End_Date_Time to be evaluated immediately after the stats command. Your SPL has some other issues as well. I suspect that you would want to use the format command instead of the return 2 line, for example.

Please back up and tell us what you are trying to accomplish. For instance, what is in the lookup table that you are bringing in, and what is it that you are trying to feed back? Where will this return value be used?

[tchintam]

Hello - I'm sorry. Here's my complete question:

My lookup:

Numbers StartDateTime EndDateTime
1 2014/01/21 01:00:00 2014/01/22 01:00:00
2 2015/02/21 02:00:00 2014/01/23 01:00:00

My query is:

search[|inputlookup abc | stats count(Numbers) as sum| eval end=strptime(End_Date_Time,"%Y/%m/%d %H:%M:%S") , start=strptime(Start_Date_Time,"%Y/%m/%d %H:%M:%S")
| eval time=(_time>"+start+" AND _time<"+end+")
| return 2 $time
| rex mode=sed field=search "s/OR/AND/g"
| return $search]

My doubt is how to pass the sum in place of 2? (I'm passing 2 since there are 2 rows)

[ppatrikfr]

Hey, i just dont get what are you trying to do here '| eval time=(_time>"+start+" AND _time<"+end+")'? Are you trying to do some conditional function or just making a string?

[tchintam]

Hey sorry for that. I guess my question got edited. Here's the complete question:

My lookup:

Numbers StartDateTime EndDateTime
1 2014/01/21 01:00:00 2014/01/22 01:00:00
2 2015/02/21 02:00:00 2014/01/23 01:00:00

My query is:

search[|inputlookup abc | stats count(Numbers) as sum| eval end=strptime(End_Date_Time,"%Y/%m/%d %H:%M:%S") , start=strptime(Start_Date_Time,"%Y/%m/%d %H:%M:%S")
| eval time=(_time>"+start+" AND _time<"+end+")
| return 2 $time
| rex mode=sed field=search "s/OR/AND/g"
| return $search]

My doubt is how to pass the sum in place of 2? (I'm passing 2 since there are 2 rows)