Pass starttime/endtime results to another search

[hortonew]

I'm trying to do something similar to what I have below, where I gather the latest transaction for when splunk was shut down, find the start/end values, and then run a search based on what happened when my search head was down. How do I use the results from one in another search?

Example

index=_audit host=searchhead-host-name* action=splunk* | transaction maxevents=2 startswith="action=SplunkShuttingDown" endswith="action=SplunkStarting" | head 1 | eval starttime=strftime(_time, "%m/%d/%Y:%H:%M:%S") | eval endtime=strftime(_time+duration, "%m/%d/%Y:%H:%M:%S") | search index=* earliest=$starttime$ latest=$endtime$

[woodcock · Accepted solution]

Like this:

index=* [ search index=_audit host=searchhead-host-name* action=splunk* | transaction maxevents=2 startswith="action=SplunkShuttingDown" endswith="action=SplunkStarting" | head 1 | eval earliest=strftime(_time, "%m/%d/%Y:%H:%M:%S") | eval latest=strftime(_time+duration, "%m/%d/%Y:%H:%M:%S") | fields earliest latest | format "(" "(" "" ")" "" ")" ]

[hortonew]

Getting: Error in 'search' command: Unable to parse the search: 'AND' operator is missing a clause on the left hand side.

Any thoughts?

[woodcock]

Answer corrected (should work now)!

[hortonew]

Awesome, thanks! Working now, but don't really understand why that format does what it does.