Time comparison - Relative and Explict

[manas]

I have a field which gives when a particular event started. Depending on time period selected in dashboard , i want to fetch all records past that time period selected in time picker input of the dashboard.

Problem is if time input is relative like "today" /"Yesterday" choice 1 below works and i get results. When time selected as input is explicit like "10/02/2025"  ,choice 2 works and i get results. 

Relative time logic :

|where timestamp2 >= relative_time(now(), "$field1.earliest$")

Explicit time logic :

|where timestamp2 >= tonumber("$field1.earliest$")

  How to enhance this ,so that irrespective of input ,will get results.

Something like below does not work :

| eval earliest_time=if(isnum("$field1.earliest$"), tonumber("$field1.earliest$"), relative_time(now(), "$field1.earliest$"))

| where  timestamp2 >= earliest_time

[ITWhisperer · Accepted solution]

Possibly the simplest answer is to let Splunk do it for you. You can use addinfo to get the search time settings and use them in your search

| addinfo
| where timestamp2 >= info_min_time

[manas]

This works . Thanks . I have multiple time pickers in dashboard as it's a comparison dashboard as given each widget has it's own time picker ,it works regardless.