How to wrap time picker tokens to always get epoch time in search on dashboard?

[Kmishkind]

I have a search with a join and subsearch I wish to apply a date range to the subsearch. I have put the search into a dashboard and changed it to a form. I updated the subsearch to use a where statement to narrow the _time.

The values from the datetime picker are passed through the field1.earliest and field1.latest token-this works just fine so long as I set the date time picker to "between" exact dates. If I use "last month" or one of the other relative fields I get errors because I get the date modifier values passed to the token d@d and @mon instead of the epoch date.

So....is there a way of wrapping the tokens to always get the epoc time or do I change my query to somehow accept epoch and/or date modifiers.

Here is the subquery
......
join name
[search sourcetype=logs

|regex user!=("[0-9].|ws_")|where isnotnull(user)

|where _time>=$field1.earliest$ AND _time<=$field1.latest$
.... ]

Thanks for your yelp

[martin_mueller]

Try this:

main search ... | join name [search earliest=$field1.earliest$ latest=$field1.latest$ sourcetype=logs user=* | regex user!= ...] ...

http://docs.splunk.com/Documentation/Splunk/6.1.2/Search/Specifytimemodifiersinyoursearch

[somesoni2]

Try this

your base search...| join name [search sourcetype=logs  
[|gentimes start=-1 | eval earliest=if(isnum($field1.earliest$),$field1.earliest$,relative_time(now(),"$field1.earliest$") | latest=if(isnum($field1.latest$),$field1.latest$,relative_time(now(),"$field1.latest$") | return earliest,latest]
|regex user!=("[0-9].|ws_")|where isnotnull(user) ....

With the subsearch with subsearch (with 'gentimes') providing earliest and latest value for subsearch, the where condition will not be required.

[Kmishkind]

No-only the subsearch.

[somesoni2]

Does the same timerange picker applies to main search??