This is what I am trying to do:
I have a time range drop down which will provide value to a dynamic populated drop down. I have tried the following but it fail saying "Invalid value "$earliest$" for time term 'earliest'"
{code}
2 days
3 days
<input type="dropdown" token="id">
<label>ID</label>
<populatingSearch fieldForValue="ID" fieldForLabel="ID">
<![CDATA[search index=login sourcetype=login_logs earliest="$earliest$" | dedup 1 ID]]>
</populatingSearch>
</input>
{code}
If I provide a string value as earliest="-2d@d" it works. But I want the drop down to populate the value in search string. Is it possible to earliest as:
as argument?
... View more