I have a dashboard that has a timechart displaying a count of values occurring every hour. My query is: index=app host=... sourcetype="..." siteType=... | timechart span=1h count(eval(status!=200)) as Fails | eval Time = strftime(_time, "%Y-%d-%m %H:%M:%S") | fields - _time | table Time, Fails This works perfectly, but I want to add a drilldown on my table so the user can click on a row and see all the values for that hour. The closest thing I have been able to come up with is this query: index=app host=... sourcetype="..." siteType=... status!=200 ((earliest=$earliest$ latest<$latest$)) But if I click on a row, it gives me a search that looks like this: index=app host=... sourcetype="..." siteType=... status!=200 ((earliest=1633096800 latest<1633702712)) And I have an error in the search, "Invalid earliest_time." What is going on here? Is there a conversion I need to do on the earliest and latest tokens to get the correct time?  ... View more