I haven't found a fix, but this is how I've been working around it: In the detection search, make sure to call addinfo . Then, you can still use info_min/max_time to filter. You just have to do the filtering yourself. Examples: index=StuffYouWant starttimeu=$info_min_time$ endtimeu=$info_max_time$ | ...   | from datamodel:"Authentication"."Failed_Authentication" | search  _time>$info_min_time$ _time<$info_max_time$ ... ... View more