1. create a background search in order to convert timepicker into epoch time and create token values for new convereted fields. </search> <search> <query>|makeresults</query> <earliest>$period_token2.earliest$</earliest> <latest>$period_token2.latest$</latest> <progress> <eval token="toearliest">strptime($job.earliestTime$,"%Y-%m-%dT%H:%M:%S.%3N%z")</eval> <eval token="tolatest">strptime($job.latestTime$,"%Y-%m-%dT%H:%M:%S.%3N%z")</eval> <set token="jobearliest">$job.earliestTime$</set> <set token="joblatest">$job.latestTime$</set> </progress> </search> Then, add this logic into your panels | eval earliest = $toearliest$ | eval latest =if($tolatest$ <= 0, now(),$tolatest$) | eval datefield=_time | where datefield >= earliest AND datefield <= latest if you want, you can also choose a different field other than _time. Just remember to convert that field into epoch time. Hope this helps!
... View more