What is the token name of the Search form's time range picker?

[j_w_660]

I want to display human readable timestamps for the Search form's default time range picker earliest and latest values. But, I can't figure out what the token name of the time range picker is.

I'm generating a SQL query to use in DB Connect and I want to specify the same time range in the SQL query as the time range picker on the Search form/page.

I'm looking for something like this to put into the SQL where clause:

| stats count | eval start=relative_time(now(), $earliest$) | convert ctime(start) | table start

where $earliest$ is coming from the standard/default time range picker.

[somesoni2 · Accepted solution]

If your Splunk search is using the time range picker, you can try like this. The gentimes is just to generate one sample row. The addinfo command is what get the absolute epoch value of the selected time range picker value.

| gentimes start=-1  | addinfo | table info_min_time info_max_time | rename info_min_time  as earliest info_max_time as latest | convert ctime(earliest) ctime(latest)

[DalJeanis]

Somesoni2 - you should move that comment to be an answer so he can accept it. Addinfo is exactly what he needs.

[somesoni2]

You want to add columns in the search result (from default search dashboard) OR you're creating a dashboard and want to selected timerange in some lebel/title?

[j_w_660]

I'm generating a SQL query to use in DB Connect and I want to specify the same time range in the SQL query as the time range picker on the Search form/page.

I'm looking for something like this:

| stats count | eval start=relative_time(now(), $earliest$) | convert ctime(start) | table start

where $earliest$ is coming from the standard/default time range picker.

[somesoni2]

Could you provide the SQL Query/Splunk Search that you're using right now? Are you using dbxquery or dbquery command to run the SQL and want to add current time range into WHERE clause somewhere?