How do I reference the start and end date from the datetime picker?

[mumblingsages]

I have an index that contains multiple date/time fields. In my search I need to filter items by _time and an addition 1 or 2 timestamps.

My problem is I don't see an obvious way to reference the date range selected by the user for the report, such that I can specify something like the following:

| where completed_timestamp >= (start date/time selected by user) AND completed_timestamp <= (end date/time selected by user)

Is this possible to do?

[woodcock · Accepted solution]

You pull them in with addinfo like this:

... | addinfo | where completed_timestamp >= info_min_time AND completed_timestamp <= info_max_time

This is often necessary when using DBConnect but in that case, you usually need to embed it in a subsearch to force the detail into the SQL string.

[mumblingsages]

This did exactly what I wanted.

[cpetterborg]

I'd do the search in a dashboard with a time picker. Then you can reference the time picker earliest and latest values as tokens in your panel's search. See:

http://docs.splunk.com/Documentation/SplunkCloud/6.6.1/Viz/TokenReference