I know this has been answered already but I came across this same problem and I wrote a bit more code to account for a few addition cases that you can come across with time picker values depending on if you use preset times, date before/after/between, advanced, etc.
So I think this should account for all the possible types of values that a time picker token can have.
I hope this helps someone else because it took me a couple hours of debugging and iterating to get this to work perfectly for me.
| eval e="$time_token.earliest$", l="$time_token.latest$"
| eval e=case(match(e, "^\d+$"), e,
e="" OR e="now", "0",
true(), relative_time(now(), e))
| eval l=case(match(l, "^\d+$"), l,
l="" OR l="now", "2145916800",
true(), relative_time(now(), l))
| eval e=tonumber(e), l=tonumber(l)
| where _time>='e' AND _time<='l'
... View more