Slightly new to Splunk, I have done a few searches in my time however, I am currently stuck on dropdowns. I have a search that is dependent on 3 dropdown inputs 2 of which are closely related to each other. 2 of which are my main concern.
To put it simply I have 1 dropdown entry which is the stand "Time" input and a second one which is "Username". What I want to be able to do is restrict the search of usernames based on what time frame the user enters on the "Time" input. I just cannot seem to get it to work and the token $time$ I have no way of entering this in?
See below the code and screenshot to provide context. Please ask any questions that might assist in me solving this. I've tried also adding in a premade time entry input panel although I'd prefer to use the default due to more presets.