How to search from 600 seconds before to 600 seconds after the time specified in the time picker on the dashboard?

[Msugiyama]

I would like to search from 600 seconds before to 600 seconds after the time specified in the time picker on the dashboard. Is there a good idea?

The time picker is also used in another panel, so it is in response to the request that I didn't want to place multiple time pickers.

=== This SPL did not pass. ===
index = _internal
earliest = $ field1.earliest $ --600
latest = $ field1.earliest $ + 600

[Msugiyama]

This is awesome!!
Resolved. Thanks!

I will relearn about TOKEN.

[Msugiyama]

Thank you for reply
What you want to search is the log related to the input to the form of the web page.

When "Today" is specified in the time picker
I can't search for a start and end if started a session at 23:50 yesterday and the session expires at 0:10 today.
For the time being, I would like to set up a buffer for about 10 minutes.

[ITWhisperer]

<form>
  <label>Time Picker token</label>
  <init>
    <eval token="earliest10minutesbefore">relative_time(now(),"-10m")</eval>
    <eval token="latest10minutesafter">relative_time(now(),"+10m")</eval>
  </init>
  <fieldset submitButton="false">
    <input type="time" token="time" searchWhenChanged="true">
      <label></label>
      <default>
        <earliest>@d</earliest>
        <latest>now</latest>
      </default>
      <change>
        <condition>
          <eval token="earliest10minutesbefore">relative_time(relative_time(now(),$time.earliest$),"-10m")</eval>
          <eval token="latest10minutesafter">relative_time(relative_time(now(),$time.latest$),"+10m")</eval>
        </condition>
      </change>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>10 minute buffer</title>
      <table>
        <search>
          <query>| makeresults
| eval earliest10minutesbefore= $earliest10minutesbefore$,
latest10minutesafter=$latest10minutesafter$
| eval earliest_time=strftime(earliest10minutesbefore,"%Y-%m-%dT%H:%M:%S"),
latest_time=strftime(latest10minutesafter,"%Y-%m-%dT%H:%M:%S")
| table earliest_time, latest_time, earliest10minutesbefore, latest10minutesafter
| fields - _time</query>
          <earliest>$earliest10minutesbefore$</earliest>
          <latest>$latest10minutesafter$</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
</form>

[ITWhisperer]

You could add a change handler to the timepicker to evaluate new tokens based on the values chosen and use those new tokens for your earliest and latest values.