https://community.splunk.com/t5/Splunk-Search/How-to-get-earliest-time-and-latest-time-token-in-JOB/m-p/398869#M172799 <P>Hi splunk comuniti!</P> <P>I have a job in splunk. In "Edit Search" i have two fields - Earliest time and Latest time. How can i get tokens of this fields to use them in search query? </P> Wed, 27 Feb 2019 07:22:12 GMT mishaaaaaaaaaa 2019-02-27T07:22:12Z https://community.splunk.com/t5/Splunk-Search/How-to-get-earliest-time-and-latest-time-token-in-JOB/m-p/398869#M172799 <P>Hi splunk comuniti!</P> <P>I have a job in splunk. In "Edit Search" i have two fields - Earliest time and Latest time. How can i get tokens of this fields to use them in search query? </P> Wed, 27 Feb 2019 07:22:12 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-earliest-time-and-latest-time-token-in-JOB/m-p/398869#M172799 mishaaaaaaaaaa 2019-02-27T07:22:12Z https://community.splunk.com/t5/Splunk-Search/How-to-get-earliest-time-and-latest-time-token-in-JOB/m-p/398870#M172800 <P>Pls try <CODE>$time_token.earliest$ and $time_token.latest$ where time_token is the name of your token</CODE></P> Wed, 27 Feb 2019 13:28:56 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-earliest-time-and-latest-time-token-in-JOB/m-p/398870#M172800 lakshman239 2019-02-27T13:28:56Z https://community.splunk.com/t5/Splunk-Search/How-to-get-earliest-time-and-latest-time-token-in-JOB/m-p/398871#M172801 <P>@lakshman239 but i don't know the name of time_token in job<BR /> I create a scheduled job and in "Edit search" tab i have two text input which is Earliest time and Latest time, and i don't know their tokens</P> Thu, 28 Feb 2019 06:18:12 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-earliest-time-and-latest-time-token-in-JOB/m-p/398871#M172801 mishaaaaaaaaaa 2019-02-28T06:18:12Z https://community.splunk.com/t5/Splunk-Search/How-to-get-earliest-time-and-latest-time-token-in-JOB/m-p/398872#M172802 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/177803">@lakshman239</a> i found how to do this, the tokens name are dispatch.latest_time and dispatch.earliest_time </P> Tue, 29 Sep 2020 23:31:04 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-earliest-time-and-latest-time-token-in-JOB/m-p/398872#M172802 mishaaaaaaaaaa 2020-09-29T23:31:04Z https://community.splunk.com/t5/Splunk-Search/How-to-get-earliest-time-and-latest-time-token-in-JOB/m-p/398873#M172803 <P>Glad it worked. Pls download the Splunk dashboard example app, if you haven't already, as it has tons of good examples like the one which you are after.</P> Thu, 28 Feb 2019 09:02:54 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-earliest-time-and-latest-time-token-in-JOB/m-p/398873#M172803 lakshman239 2019-02-28T09:02:54Z