Dynamically passing time-picker token in startime for "|gentimes"

[egonstep]

Hello all, I have a dashboard and I need the "|gentimes" command to generate dynamic values accordingly to the selected time picker. Picking up the earliest event from the search.

 | gentimes start=$field1.earliest$ increment=3h
 | convert timeformat="%Y/%m/%d - %H" ctime(starttime)
 | rename starttime as date
 | table date

I tried to search inside the start argument but It throws an error:

   [subsearch]: command="gentimes", generatetimestamps requires start=mm/dd/yyyy:hh:mm:ss and optional takes 'end' and  'increment' values

The full query (with gentimes error):

base search
| append
    [| gentimes start= [search "base search"
     | tail 1
     | convert timeformat="%m/%d/%Y:%H:%M:%S" ctime(_time) as dt
     | eval firstEvent = dt
     | return $firstEvent] increment=3h
 | convert timeformat="%Y/%m/%d - %H" ctime(starttime)
 | rename starttime as defaultDate
 | table defaultDate]

Thanks.

[cmerriman]

Make the subsearch in gentimes into a post process/base search and pass a token. I believe the reason it doesn't work is the way that it passes the argument.

<dashboard>
......
        <search>
         <query>"base search"
      | tail 1
      | convert timeformat="%m/%d/%Y:%H:%M:%S" ctime(_time) as dt
      | return $dt</query> 
          <done>
            <set token="token">$result.dt$</set>
          </done>
          <earliest>$earliest$</earliest>
          <latest>$latest$</latest>
        </search>
  <row>
    <panel>
      <table>
        <search>
          <query>base search
 | append
     [| gentimes start=$token$  increment=3h| convert timeformat="%Y/%m/%d - %H" ctime(starttime)
  | rename starttime as defaultDate
  | table defaultDate]</query>
.........
</dashboard>

[egonstep]

@cmerriman Thanks for your response. But unfortunately, it throws another error:

[subsearch]: command='gentimes', invalid literal for int() with base 10: "$result.dt$"