I'd like to save the earliest time and latest time from a selection on the default dashboard time picker. When a user of the dashboard selects a Date&Time range I'd like to display that date and time range on the dashboard for clarity.
Best case would be putting that token in a title, second best would be adding a single value to display it.
Any suggestions? I tried using the token $field1$ but the search wouldn't run.
You can use following search to get the current selected time-range picker value.
|gentimes start=-1 | addinfo | convert ctime(*) | eval message="Total failed attempts ".info_min_time." to ".info_max_time | table message
Now you can run this search as a single value panel OR run as separate search element and setup tokens with value from the results (and then use the token in your title/label).
http://docs.splunk.com/Documentation/Splunk/6.5.1/Viz/tokens#Search_tokens_for_dynamic_display_examp...