| eval e="$time_token.earliest$", l=$time_token.latest$"| eval e=case(match(e,"^\d+$"),e,e="" OR e="now" , "0" , true(), relative_time(now(),e)) | eval l=case(match(l,"^\d+$"),l,l="" OR l="now" , "2145916800", true(), relative_time(now(),l))
@pavanraghav ,
In your search above, you are missing a "
in I=$time_token.latest$"
Also , please use the Code Sample
to add your search snippets. I edited it for now
your missing a quote in your eval
| eval e="$time_token.earliest$", l="$time_token.latest$"
| eval e=case(match(e,"^\d+$"),e,e="" or e="now" , "0" , true(), relative_time(now(),e))
| eval l=case(match(l,"^\d+$"),l,l="" or l="now" , "2145916800", true(), relative_time(now(),l))
thanks arjun
@pavanraghav ,
In your search above, you are missing a "
in I=$time_token.latest$"
Also , please use the Code Sample
to add your search snippets. I edited it for now
thanks renjith