Is there a way to use the time range set by the Preset Time Token as earliest and latest values in a string. For example, if I my time token name is token_time and I set the range on a Dashboard to "Year to date" is there some name or field name I can then use in the search earliest and latest option of token_time to reflect those dates so that I can use them in another search?
earliest = the value for 1/01/2022
latest = now
Thanks in advance.
Hi @JoeHubner,
you should see the addinfo command (https://docs.splunk.com/Documentation/SplunkCloud/8.2.2202/SearchReference/Addinfo).
It gives you the informations you need.
Ciao.
Giuseppe