Hello,
I have a query where I need to filter a date DateOpen_EPOC (already in EPOC format) with a time picker (token is date_open). This time picker is not linked to default _time.
From a past question on the forum, I got this which works fine in most of the case:
(...)
| where DateOpen_EPOC >= if(replace("$date_open.earliest$","\d","")!="",relative_time(now(),"$date_open.earliest$"),"$date_open.earliest$")
AND DateOpen_EPOC >= if(replace("$date_open.latest$","\d","")!="",relative_time(now(),"$date_open.latest$"),"$date_open.latest$")
(...)
However this query does not work in (at least) in two specific cases:
- Time Picker = "All time" --> in that case, it looks $date_open.earliest$ and $date_open.latest$ return nothing and it does not work
- Time Picker = "Last 7 days" (for instance). Here $date_open.latest$ equals now and it does not work
Any suggestion to improve (or replace) this query to truly manage all cases ?
Thanks.
Like this (NOTE: one of your >
should surely have been <
😞
(...)
| addinfo | where DateOpen_EPOC>=info_min_time AND DateOpen_EPOC<=info_max_time
(...)