Is it possible to reuse the tokens from the timerangepicker later in a form?

[HeinzWaescher]

Hi,

I'm wondering whether it is possible to reuse the tokens from the timerangepicker in a form.

1. The panels interacts as usual when the timerangepicker is used
2. In a later pipe I would like to reuse the chosen time tokens from the timerangepicker (earliest & latest) for another calculated field (!= _time).

Is that possible?
thanks in advance

[gcusello · Accepted solution]

Hi HeinzWaescher,
yes, it's possible, if your Time Picker Token is called "Time", you can use $Time.earliest$ and $Time.latest$ as usual tokens.
Bye.
Giuseppe

[HeinzWaescher]

Awesome, that's something I hoped for. This will make things a lot easier 🙂
Thanks

[HeinzWaescher]

I recognized that this can't handle relative times used in the timerange picker. Earliest and latest are not converted into epochtime.

For example this results in:

| search creation_ts>=-2w@w1 AND creation_ts<=@d

Can we solve these cases directly in this search pipe? Or the best solution to tell dashboard users only to select date ranges?

[HeinzWaescher]

I found an answer that seems to help here:
Like:

| where creation_ts< [|gentimes start=-1 | addinfo | eval search=info_max_time | table search]

[gcusello]

Hi HeinzWaescher,
if you display earliest and latest in a dashboard, you see that they are displayed in epochtime.
To use in search, use the where command instead search and use brackets:

| where creation_ts>="$Time.earliest$" AND creation_ts<="$Time.latest$"

Bye.
Giuseppe

[HeinzWaescher]

Hm, I'm still facing the problem.

Used timerangepicker: -2w@w1 to @d

My search filter is:

| where creation_ts>="$Timer.earliest$" AND creation_ts<="$Timer.latest$"

Doing a stats afterwards it shows:
man(creation_ts)=2016-12-14 (this should not be possible after there where command)
max(creation_ts)=2017-08-01

When I open the finalized search from the panel, there where clause is shown as:
| where creation_ts>="-2w@w1" AND creation_ts<="@d"