You could either do a simple string match where clause on the PUBLISHED_DATETIME field or comvert it to epoch and compare. | where match(PUBLISHED_DATETIME, "^2022-05-03") of course if you want to compare always against yesterday, then you would need to make a field with yesterday's date. Here's an example that creates some dummy dates and then searches for yesterday | makeresults count=20 | eval today=strftime(now(), "%Y-%m-") | eval day=tonumber(strftime(now(), "%d")) - 1 | eval PUBLISHED_DATETIME=today."0".(random() % day + 1) | eval yesterday=strftime(relative_time(now(), "-d@d"), "^%F") | where match(PUBLISHED_DATETIME, yesterday) So, you need to format a string like eval yesterday=... and then the where clause will string match. Alternatively you can do with with epoch comparison with numeric comparison after parsing the PUBLISHED_DATETIME and calculating start end end times for yesterday, e.g.  | makeresults count=20 | eval today=strftime(now(), "%Y-%m-") | eval day=tonumber(strftime(now(), "%d")) - 1 | eval PUBLISHED_DATETIME=today."0".(random() % day + 1)."T08:00:00Z" | eval pdate=strptime(PUBLISHED_DATETIME,"%FT%TZ") | eval yesterday_start=relative_time(now(), "-d@d") | eval yesterday_end=relative_time(now(), "@d") | where pdate>=yesterday_start AND pdate<yesterday_end You can run both of these example searches that will show you how it works     ... View more

Reads like what you need is "AND" not "OR".  You want to give each dropdown token a default  value of "*", then use index=*|lookup bar.csv IP OUTPUT BAR BAR_Status |search BAR="$field1$" AND BAR="$field4$"|chart count(IP) by BAR,STATUS This way, the unselected dropdown will always result in a true condition. (You may also want to see if there is a different workflow for the dashboard to avoid two dropdowns for the same field.  Additionally, you want to give input tokens descriptive names.) ... View more

Don't worry about it.  Once you convert the fields into epoch form so you can compare them they will be in epoch form.  When you then format them for display they'll be in your selected time zone. For example: index=foo | eval First=strptime(FIRST_FOUND_DATETIME, "%Y-%m-%dT%H:%M:%S%Z"), Last=strptime(LAST_FOUND_DATETIME, "%Y-%m-%dT%H:%M:%S%Z") | where First <= relative_time(now(), "-7d") AND Last <= relaive_time(now(), "-6d") ... ... View more