Drop Down Menu with Time

The simplified XML uses the stringreplace intention, and the stringreplace intention is unique in that you have to specify in the search string where exactly the $timeSpan$ token should be inserted.

So in light of that, one thing to try is changing your search to

sourcetype="cron_BalanceEmail" (source="*asia*" OR source="*info*" OR source="*org*") starthoursago="120" BalanceEmail sent | rex field=_raw "\[BalanceEmail\] ?(?<TotalEmailsSent>[\d]+) of (?<TotalEmailsToSend>[\d]+) of email notification sent\." | search TotalEmailsToSend="*" OR TotalEmailsSent="*" | timechart $timeSpan$ sum(TotalEmailsToSend) as TotalEmailsToSend sum(TotalEmailsSent) as TotalEmailsSent

(Note the $timeSpan$ token now living in the timechart clause)

An obvious problem with the stringreplace intention here is of course that the saved search will not function correctly outside of this one custom view. The $timeSpan$ argument will not get replaced when the search is run straight from the menu so it'll throw a search language syntax error. What you have to do then if you want that saved search to be both visible and functional, is to specify the search inline with <search> instead of <searchName> or use a different saved search that is configured with is_visible=False.

This is the xml that adds the time drop down menu and execute the new search when changed:

<form>
<label>FOO</label>
<title>Total Emails For All Registries</title>
<fieldset autoRun="true" submitButton="false">
    <input type="time" searchWhenChanged="true" />
    <default>Last 24 hours</default>
</fieldset>
<row>
    <chart>
        <title>Matching events</title>
        <searchTemplate><![CDATA[ sourcetype="cron_BalanceEmail" (source="*asia*" OR source="*info*" OR source="*org*") BalanceEmail sent | rex field=_raw "\[BalanceEmail\] ?(?<TotalEmailsSent>[\d]+) of (?<TotalEmailsToSend>[\d]+) of email notification sent\." | search TotalEmailsToSend="*" OR TotalEmailsSent="*" | timechart sum(TotalEmailsToSend) as TotalEmailsToSend sum(TotalEmailsSent) as TotalEmailsSent ]]></searchTemplate>
        <option name="charting.chart">column</option>
        <option name="charting.primaryAxisTitle.text">Date</option>
        <option name="charting.secondaryAxisTitle.text">Number of Emails</option>
        <option name="charting.chart.useAbsoluteSpacing">true</option>
        <option name="charting.chart.columnSpacing">5</option>
        <option name="charting.legend.placement">top</option>
  <module name="TimeRangePicker">
  <param name="selected">All time</param>
  <param name="searchWhenChanged">True</param>
   </module>
</chart>