Answer by warren for How to reference an eval variable in query

Why are you trying to eval those time values?

Just do:

index=* earliest=-8d latest=-1d
| <rest of search>
| appendcols [
    search (index=*) earliest=-1d
    | <rest of appended search>
] 

There’s no need to explicitly set latest unless you want something other than now()

from User warren – Stack Overflow https://stackoverflow.com/questions/66023059/how-to-reference-an-eval-variable-in-query/66032236#66032236
via IFTTT