Use token in the dropdown choice value

[karthi25]

I have a dropdown with choice values as follows:

        <label>SELECT A TASK NAME</label>

        <choice value="taskName='aaa' status='COMPLETED'| sort -splunkLogId | eval startDateModified= strptime( startDate, &quot;%Y-%m-%d %H:%M:%S&quot;) | eval newDateFromDash = relative_time($dashboardTime.latest$(), &quot;$dashboardTime.earliest$&quot;)
 | where startDateModified > newDateFromDash | eval runDate = strftime(strptime(startDate, &quot;%Y-%m-%d&quot;),&quot;%Y-%m-%d&quot;) |chart sum(rowCount) over runDate">aaa</choice>

        <choice value="taskName='bbb' status='COMPLETED'| sort -splunkLogId |eval startDateModified= strptime( startDate, &quot;%Y-%m-%d %H:%M:%S&quot;) | eval newDateFromDash = relative_time($dashboardTime.latest$(), &quot;$dashboardTime.earliest$&quot;)
 | eval runDate = strftime(strptime(startDate, &quot;%Y-%m-%d&quot;),&quot;%Y-%m-%d&quot;) |chart sum(rowCount) over runDate">bbb</choice>
        .....
        <selectFirstChoice>true</selectFirstChoice>
      </input>

"dashboardTime" is nothing but my time select box token. But the choice value is not getting update with the corresponding values of $dashboardTime.latest$ and $dashboardTime.earliest$ instead it is update with the string "$dashboardTime.latest$ " and "$dashboardTime.earliest$".
Can anyone please suggest me to do it.

[bojanisch]

Have you set searchWhenChanged = true on the time range picker?

Alternatively why do you parse the time token in your queries? I suggest you to use a changed snippet that transforms the time string constraint directly into an epoch value that can be used in your queries:

<change>
    <eval token="earliest">if(isnum($time.earliest$), $time.earliest$, relative_time(now(), $time.earliest$))</eval>
    <eval token="latest">if(isnum($time.latest$), $time.latest$, relative_time(now(), $time.latest$))</eval>
</change>

You can simply add this to the input definition of your time range picker and use the new tokens $earliest$ and $latest$ for time comparisons. You could also add more tokens and formations, depending on your needs.

Oh and by the way, in your example (your first query) you also need to escape > into > .

[493669]

also share my time select box query to understand better