New comment on reddit

If I understand you correctly, it sounds like you likely want a pair of searches – the first will run against the last 2 weeks, and dump the results into a lookup table

The second will open the lookup table, grab only data from the last 24h, and send those

Here's a very rough sample:

index=ndx sourcetype=srctp host=* ip=* earliest=-336h | eval when=_time | table host ip _time when | outputlookup twoweeks.csv 

Follow-on:

| inputlookup twoweeks.csv | eval filter=now()-86400 | where when>filter | table host ip _time