It would be helpful for the basic string search functions to support time shifting in their searches.

Use case example: I have a string that may appear for a few seconds every so often, but should never happen outside of that window.

I.e. the string will show up in a logrt item once every couple seconds per minute, and then won't show up again for a few hours. I want to alert on when the string is showing up, but not if it's happening in one of these narrow windows.

My Zabbix-side solution would be to construct a trigger expression that alerts if the string has shown up in the last minute and also in the minute before that, and also in the minute before that; if the string is making appearances for longer than a minute minute, it would hit all three time zones. If it does not, it would hit at most two out of three zones, and I wouldn't alert.

This depends on being able to define a time zone that isn't "the last sixty seconds", but "the sixty seconds starting one hundred twenty seconds ago" and "the sixty seconds starting one hundred eighty seconds ago". Thus, time shifting.