Help on an input time token

[jip31]

Hello

I use an input time token called "timepicker"

<earliest>$timepicker.earliest$</earliest>
        <latest>$timepicker.latest$</latest>

 Is there a way to call this input time token directly in my search ?

Someting like this :

Index=toto sourcetype=tutu earliest=$timepicker$ latest=$timepicker$ 

Thanks 

[jip31]

Is anybody can help please?

[richgalloway]

Reference the tokens in the search the same way they are referenced the Simple XML.

[jip31]

right, it works

earliest=$timesource.earliest$ latest=$timesource.latest$

But is it possible to add this token somewhere else than just after the index and the sourcetype?

for example, this doesnt works

| search earliest=$timesource.earliest$ latest=$timesource.latest$

[richgalloway]

Please explain what you mean by "this doesnt works".  What results do you get compared to what you expect?

Depending on what is in your query prior to the search command, you may be running into the known limitation described at https://docs.splunk.com/Documentation/Splunk/8.2.4/SearchReference/Search#Using_the_search_command_l....

[jip31]

In my dashboard i use 2 input time tokens

I also use 2 base search in order to display data in 2 table panels

These 2 table panels refer to the 2 input time token 

As the search are the same i want to use just one base search instead two

Actually i use 2 base search due to the 2 différents input time token

The problem is that in my base search i cant refer to 2 différent input time token

So i search a way to use just one base search with 2 input time tokens...

[richgalloway · Accepted solution]

If you have to use two different time windows then you'll need two base searches.

If you really want to use a single base search then you'll have to use only one time window.