Hi,
I am using the Splunk's timepicker Date Range selection with token "timestamp".
![alt text][1]
[1]: /storage/temp/162279-timepicker.png
In panel search, this token is used as :
` index=xyz sourcetype=abc earliest=$timestamp.earliest$ latest=$timestamp.latest$`
When I select before condition, the value passed to earliest is null and because of it no result is shown.
`index=xyz sourcetype=abc earliest= latest=1475260200`
I kept default earliest as 0 in fieldset, but null issue occurs again if I select some presets and then go back to Before Date Range selection.
One way I was trying to achieve it ,is to assign 0 value to $timestamp.earliest$ if its null. I have used following fieldset, but it didn't worked.
> `
↧