I want to use my timerange as a filter in a search on a dashboard, like this:
..... | where mydate < $timepicker.latest$
But i need to conver values like "@d" , "-1h" and so on to epoch.
And the latest may be already in epoch format. Then I do not need to convert.
How can I do this?
If the same timepicker is used to define timerange for the search then, this should work.
your search ..| where mydate < [|gentimes start=-1 | addinfo | eval search=info_max_time | table search]
The 'addinfo' command will create fields info_min_time (based on search's earliest time) and info_max_time (based on search's latest time) which are in epoch already.
For this notation you can use the
... | where mydate < relative_time(now(), "$timepicker.latest$")
However, you first need to check whether it's a number or not and only apply this if it isn't:
... | where mydate < if(isnum("$timepicker.latest$"), $timepicker.latest$, relative_time(now(), "$timepicker.latest$"))
Note, I'm not 100% certain if this catches every case imaginable or not - make sure you test everything your users will need later.
It appears you also have to catch a value of "now" explicitly, i.e.
... | where mydate < case(isnum("$timepicker.latest$"), $timepicker.latest$, $timepicker.latest$="now", now(), 1=1, relative_time(now(), "$timepicker.latest$"))