https://community.splunk.com/t5/Splunk-Enterprise/How-to-pass-quot-Preset-Timeranges-quot-as-tokens-in-query/m-p/515702#M3102 <P>HI,</P><P>I am trying to pass presets from timepicker as tokens in my query.</P><P>EX: "BETWEEN" ,"SINCE"</P><P>earliest = 23/08/2020 latest 24/08/2020</P><P>I need to pass above date when I select "BETWEEN" in timerange picker as token in my query.</P><P>Similarly when I select since,last24hrs,last7days,etc.</P><P>current code used:</P><P>&nbsp;&lt;input type="time" id="date" token="lowerdate" searchWhenChanged="true"&gt;<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;label&gt;Date&lt;/label&gt;<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;default&gt;<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;earliest&gt;*&lt;/earliest&gt;<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;latest&gt;*&lt;/latest&gt;<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;/default&gt;<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;/input&gt;</P><P>&lt;search&gt;<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;queryindex = ABCD &nbsp;|search DATE = $db_earliest$|table DATE&lt;/query&gt;<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;earliest&gt;-48h@h&lt;/earliest&gt;<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;latest&gt;now&lt;/latest&gt;<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;progress&gt;</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;eval token="db_earliest"&gt;strftime("$lowerdate.earliest$", "%Y%m%d")&lt;/eval&gt;</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;eval token="db_latest"&gt;if (match("$lowerdate.latest$","now"), strftime(now(),"%Y%m%d"), strftime("$lowerdate.latest$", "%Y%m%d"))&lt;/eval&gt;</P><P>&lt;/progress&gt;<BR />&nbsp;&lt;/search&gt;</P><P>any suggestions would be great</P> Mon, 24 Aug 2020 07:12:11 GMT Ashwini008 2020-08-24T07:12:11Z https://community.splunk.com/t5/Splunk-Enterprise/How-to-pass-quot-Preset-Timeranges-quot-as-tokens-in-query/m-p/515702#M3102 <P>HI,</P><P>I am trying to pass presets from timepicker as tokens in my query.</P><P>EX: "BETWEEN" ,"SINCE"</P><P>earliest = 23/08/2020 latest 24/08/2020</P><P>I need to pass above date when I select "BETWEEN" in timerange picker as token in my query.</P><P>Similarly when I select since,last24hrs,last7days,etc.</P><P>current code used:</P><P>&nbsp;&lt;input type="time" id="date" token="lowerdate" searchWhenChanged="true"&gt;<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;label&gt;Date&lt;/label&gt;<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;default&gt;<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;earliest&gt;*&lt;/earliest&gt;<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;latest&gt;*&lt;/latest&gt;<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;/default&gt;<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;/input&gt;</P><P>&lt;search&gt;<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;queryindex = ABCD &nbsp;|search DATE = $db_earliest$|table DATE&lt;/query&gt;<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;earliest&gt;-48h@h&lt;/earliest&gt;<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;latest&gt;now&lt;/latest&gt;<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;progress&gt;</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;eval token="db_earliest"&gt;strftime("$lowerdate.earliest$", "%Y%m%d")&lt;/eval&gt;</P><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &lt;eval token="db_latest"&gt;if (match("$lowerdate.latest$","now"), strftime(now(),"%Y%m%d"), strftime("$lowerdate.latest$", "%Y%m%d"))&lt;/eval&gt;</P><P>&lt;/progress&gt;<BR />&nbsp;&lt;/search&gt;</P><P>any suggestions would be great</P> Mon, 24 Aug 2020 07:12:11 GMT https://community.splunk.com/t5/Splunk-Enterprise/How-to-pass-quot-Preset-Timeranges-quot-as-tokens-in-query/m-p/515702#M3102 Ashwini008 2020-08-24T07:12:11Z