What is the best way to join search queries in different time zones? I have tried following and it doesn't work. It just goes through everything and disregards the earliest and latest completely.
Query 1 | eval earliest=if(isnum("$timepicker1.earliest$"),strftime("$timepicker1.earliest$",'%m/%d/%Y:%H:%M:%S'),"$timepicker1.earliest$") | eval latest=if(isnum("$timepicker1.latest$"),strftime("$timepicker1.latest$",'%m/%d/%Y:%H:%M:%S'),"$timepicker1.latest$") | fields earliest latest| join [search Query 2 | eval earliest=if(isnum("$timepicker2.earliest$"),strftime("$timepicker2.earliest$",'%m/%d/%Y:%H:%M:%S'),"$timepicker2.earliest$") | eval latest=if(isnum("$timepicker2.latest$"),strftime("$timepicker2.latest$",'%m/%d/%Y:%H:%M:%S'),"$timepicker2.latest$") | fields earliest latest ]
... View more