In advanced xml I was using a lot the ResultsHeader module, amongst others it is showing nicely the "earliest" and "latest" in human readable format. How could I reproduce something like that in simple xml?
I solved the problem based on an answer from Ayn in this question and presented it with a SingleValue component:
... | addinfo | eval selection_duration=strftime(info_min_time,"%+") . " - " . strftime(info_max_time,"%+") | table selection_duration
I solved the problem based on an answer from Ayn in this question and presented it with a SingleValue component:
... | addinfo | eval selection_duration=strftime(info_min_time,"%+") . " - " . strftime(info_max_time,"%+") | table selection_duration