I am trying to include a url for a report in my notable event email. I would like the url to use the result time token as the latest field, and the time-60m as the earliest. So that if I check the email hours later I can still see the report from the events time frame.
But they do not seem to work. The result.time value itself is fine, it is a matter of doing the result.time-60m for earliest. If I hard code the values it works so I know it is possible with the configured report.
Has anyone had experience in doing this? I appreciate the time and help 🙂