The time picker looks only at the _time field, not sys_created_on or any other. Any filtering on other time fields has to be done manually. If sys_created_on is in epoch (integer) form then this may help. SEARCH
| dedup dv_number
| addinfo
| where (sys_created_on >= info_min_time AND sys_created_on <= info_max_time
| table sys_created_on dv_number dv_u_username_id assignment_group_name dv_assigned_to dv_u_workstation_ci dv_cmdb_ci dv_u_location_1 description dv_close_notes u_last_3_worknotes dv_close_notes
| rename sys_created_on AS "Created On", dv_number AS "Incident Number", dv_u_username_id AS "Username", assignment_group_name AS "Assignment Group", dv_assigned_to AS "Assigned to", dv_u_workstation_ci AS "Workstation ID", dv_cmdb_ci AS "CI" dv_u_location_1 AS "Location", description AS "Description", dv_close_notes AS "Closing Notes", u_last_3_worknotes AS "Last 3 Work Notes", dv_close_notes AS "Closing Notes"
| sort by "Incident Number" desc If sys_created_on is a text field ("04/21/2021", for example) then it must be converted to an integer using the strptime function. That's left as a exercise for the reader.
... View more
