I need to compare my timepicker values (timePicker token) to the field date_e which returns an epoch value.
I convert my timepicker to epoch using if command.
My search goes something like this,
| eval e = if(isnum($timePicker.earliest$), $timePicker.earliest$, relative_time(now(), "$timePicker.earliest$"))
| eval l = if(isnum($timePicker.latest$), $timePicker.latest$, relative_time(now(), "$timePicker.latest$"))
| where date_e>= e AND date_e<= l
This is fine if the user selects two dates using 'Between' in timepicker.
However, if the user chooses 'Month to Date', I encounter an error
Error in 'eval' command: The expression is malformed. An unexpected character is reached at '@mon), @mon, relative_time(now(), "@mon"))".
I'm sorry but I'm not using timepickers to filter the search itself, which is why I don't think I can use info_min_time and info_max_time. I'm only using the timepicker to compare it to date_e. My time range for this table is set to 'Global'.