I think because the 'earliest' param of the Search module is not doing $foo$ substitution, that you're not using the most recent Sideview Utils app. If you're still using the version on Splunkbase, that version is very old. What's on Splunkbase is 1.3.X, but you can get the considerably newer 2.1.X version from the sideview site ( http:/sideviewapps.com/apps/sideview-utils ). In the newer version the earliest and latest params also do $foo$ substitution.
... View more