How to display a time range token

[Jamietriplet]

Hello guys, I am trying to add a time range to my search, so the user can pick any time range and see data for the selected time (e.g. 24hours, last 30 days, previous year etc), . I created a time range control and token for this purpose, called TimeRange. But when I run my query, I get the below error:

Invalid value "$TimeRange$" for time term 'earliest'

Here is my query:
base query earliest = $TimeRange$, latest=now ()
| other query

[ITWhisperer]

Your panel will have a search (data source) associated with it - how is that data source configured (with respect to timeframe)?

[Jamietriplet]

index=Index name sourcetype=sourcetype name (field names)earliest=$TimeRange$ latest=now()

[ITWhisperer]

I am not sure why you won't show us what you do have - perhaps we might be able to see what is wrong - what you are sharing with us at the moment is not moving things forward.

[Jamietriplet]

Hello @ITWhisperer , I tried this and got this same error:
Invalid value "$TimeRange.earliest$" for time term 'earliest

[dural_yyz]

Please share the source code for the Time Selection dropdown and for the search panel you are referencing the token.

[Jamietriplet]

hello @dural_yyz ,

This is the source code for the control and token

{

    "options": {

        "defaultValue": "-24h@h,now",

        "token": "TimeRange"

    },

    "title": "Time Selection",

    "type": "input.timerange"

}

see the picture for the panel 
Screenshot 2024-12-03 130629.png

[dural_yyz]

Share the panel that is referencing the TimeRange with the error.

[Jamietriplet]

Do you mean the control panel?Screenshot 2024-12-03 145254.png

[dural_yyz]

There is a search panel you are trying to pass the variables to.  The panel that gives an error when trying to use the token values.

[Jamietriplet]

index=Index name sourcetype=sourcetype name (field names)earliest=$TimeRange$ latest=now()

[dural_yyz]

---

@Jamietriplet wrote:

index=Index name sourcetype=sourcetype name (field names)earliest=$TimeRange$ latest=now()

---

index=Index name sourcetype=sourcetype name (field names)earliest=$TimeRange.earliest$ latest=$TimeRange.latest$

[Jamietriplet]

Its important to note that i wrote a similar line of code for another panel and got no error, see below:

index = index name sourcetype = sourcetype name (field names) earliest =$StartTime$  latest=$FinishTime$

[Jamietriplet]

Tried this already and got this error:

Invalid value "$TimeRange.earliest$" for time term 'earliest'

[ITWhisperer]

Please show what is in your token and how you have set it

[Jamietriplet]

Token was set using the time range control. see below image

Screenshot 2024-12-03 130629.png

[ITWhisperer]

Try something like this

earliest = $TimeRange.earliest$, latest=$TimeRange.latest$

[Jamietriplet]

Its important to note that i wrote a similar line of code for another panel and got no error, see below:

index = index name sourcetype = sourcetype name (field names) earliest =$StartTime$  latest=$FinishTime$