I have an index that contains multiple date/time fields. In my search I need to filter items by _time and an addition 1 or 2 timestamps.
My problem is I don't see an obvious way to reference the date range selected by the user for the report, such that I can specify something like the following:
| where completed_timestamp >= (start date/time selected by user) AND completed_timestamp <= (end date/time selected by user)
Is this possible to do?
You pull them in with addinfo like this:
... | addinfo | where completed_timestamp >= info_min_time AND completed_timestamp <= info_max_time
This is often necessary when using DBConnect but in that case, you usually need to embed it in a subsearch to force the detail into the SQL string.
View solution in original post
This did exactly what I wanted.
I'd do the search in a dashboard with a time picker. Then you can reference the time picker earliest and latest values as tokens in your panel's search. See: