topic Re: Help on an input time token in Getting Data In

Help on an input time token

jip31 — Tue, 25 Jan 2022 17:02:40 GMT

Hello

I use an input time token called "timepicker"

<earliest>$timepicker.earliest$</earliest>
        <latest>$timepicker.latest$</latest>

Is there a way to call this input time token directly in my search ?

Someting like this :

Index=toto sourcetype=tutu earliest=$timepicker$ latest=$timepicker$

Thanks

richgalloway — Tue, 25 Jan 2022 19:36:39 GMT

Reference the tokens in the search the same way they are referenced the Simple XML.

jip31 — Wed, 26 Jan 2022 06:09:39 GMT

right, it works

earliest=$timesource.earliest$ latest=$timesource.latest$

But is it possible to add this token somewhere else than just after the index and the sourcetype?

for example, this doesnt works

| search earliest=$timesource.earliest$ latest=$timesource.latest$

richgalloway — Wed, 26 Jan 2022 13:10:14 GMT

Please explain what you mean by "this doesnt works". What results do you get compared to what you expect?

jip31 — Wed, 26 Jan 2022 17:12:13 GMT

In my dashboard i use 2 input time tokens

I also use 2 base search in order to display data in 2 table panels

These 2 table panels refer to the 2 input time token

As the search are the same i want to use just one base search instead two

Actually i use 2 base search due to the 2 différents input time token

The problem is that in my base search i cant refer to 2 différent input time token

So i search a way to use just one base search with 2 input time tokens...

jip31 — Thu, 27 Jan 2022 16:01:58 GMT

Is anybody can help please?

richgalloway — Fri, 28 Jan 2022 19:50:40 GMT

If you have to use two different time windows then you'll need two base searches.

If you really want to use a single base search then you'll have to use only one time window.