I know this has been answered already but I came across this same problem and I wrote a bit more code to account for a few addition cases that you can come across with time picker values depending on if you use preset times, date before/after/between, advanced, etc. So I think this should account for all the possible types of values that a time picker token can have. I hope this helps someone else because it took me a couple hours of debugging and iterating to get this to work perfectly for me. | eval e="$time_token.earliest$", l="$time_token.latest$" | eval e=case(match(e, "^\d+$"), e, e="" OR e="now", "0", true(), relative_time(now(), e)) | eval l=case(match(l, "^\d+$"), l, l="" OR l="now", "2145916800", true(), relative_time(now(), l)) | eval e=tonumber(e), l=tonumber(l) | where _time>='e' AND _time<='l' ... View more