Hi,
As per my understanding, I have designed the below query which prints the start date and end date according to the date selected in the time picker,
| makeresults
| eval start_date="$timepicker.earliest$", end_date="$timepicker.latest$"
| eval x = if(isnum(start_date),start_date,relative_time(now(), start_date))
| eval y = if(isnum(end_date),end_date,case(end_date == "now", now(), end_date == "", now(), 1=1,relative_time(now(), end_date)))
| convert timeformat="%d-%m-%Y %H:%M:%S" ctime(x) AS StartDate
| convert timeformat="%d-%m-%Y %H:%M:%S" ctime(y) AS EndDate
| table StartDate, EndDate
It handles all the cases, which are present in the time picker except real time as make result doesn't support that.
Supported cases are given below,
presets
relative
date range
date and time range
advanced
Note:
In case you select any time range in which the time interval becomes [beginning of time, any time] then the start date will be empty.
Happy Splunking!!!
... View more