Hi,
I'm wondering whether it is possible to reuse the tokens from the timerangepicker in a form.
Is that possible?
thanks in advance
Hi HeinzWaescher,
yes, it's possible, if your Time Picker Token is called "Time", you can use $Time.earliest$
and $Time.latest$
as usual tokens.
Bye.
Giuseppe
Hi HeinzWaescher,
yes, it's possible, if your Time Picker Token is called "Time", you can use $Time.earliest$
and $Time.latest$
as usual tokens.
Bye.
Giuseppe
Awesome, that's something I hoped for. This will make things a lot easier 🙂
Thanks
I recognized that this can't handle relative times used in the timerange picker. Earliest and latest are not converted into epochtime.
For example this results in:
| search creation_ts>=-2w@w1 AND creation_ts<=@d
Can we solve these cases directly in this search pipe? Or the best solution to tell dashboard users only to select date ranges?
I found an answer that seems to help here:
Like:
| where creation_ts< [|gentimes start=-1 | addinfo | eval search=info_max_time | table search]
Hi HeinzWaescher,
if you display earliest and latest in a dashboard, you see that they are displayed in epochtime.
To use in search, use the where command instead search and use brackets:
| where creation_ts>="$Time.earliest$" AND creation_ts<="$Time.latest$"
Bye.
Giuseppe
Hm, I'm still facing the problem.
Used timerangepicker: -2w@w1 to @d
My search filter is:
| where creation_ts>="$Timer.earliest$" AND creation_ts<="$Timer.latest$"
Doing a stats afterwards it shows:
man(creation_ts)=2016-12-14 (this should not be possible after there where command)
max(creation_ts)=2017-08-01
When I open the finalized search from the panel, there where clause is shown as:
| where creation_ts>="-2w@w1" AND creation_ts<="@d"