I am trying to pass a time value using a workflow action, and then use init in the dashboard to create a new time range for the search. What happens is the URL is re-written as the dashboard runs with values for my time picker that are wrong. In the URL, I pass a value "base_time" which is the ending time of the event I'm interested in. I want the dashboard to run its searches 24 hours prior to the base and 4 hours after. So I init the values of the time picker, which is token=field2 as well as make some easy to read versions of tthe time. <form> <init> <eval token="form.field2.earliest">$base_time$ - 86400</eval> <eval token="form.field2.latest">$base_time$ + 14400</eval> <eval token="base_time_str">strftime($base_time$, "%m/%d/%Y %H:%M:%S")</eval> <eval token="earliest_str">strftime($form.field2.earliest$, "%m/%d/%Y %H:%M:%S")</eval> <eval token="latest_str">strftime($form.field2.latest$, "%m/%d/%Y %H:%M:%S")</eval> </init> Later in the dashboard is the time picker: <input type="time" token="field2"> <label></label> <default> <earliest>$form.field2.earliest$</earliest> <latest>$form.field2.latest$</latest> </default> </input> It doesn't work; what seems to happen is the URL gets re-written with the variable names, not the actual time values. If this is important, it's being called from a Enterprise Security notable event. ... View more

My SOC wants a page showing all recent notables, and which ones were suppressed by the current suppression rules. Obviously I can list notables with index=notable but how can I easily indicate the ones that actually showed up in Incident Review vs. the ones that were suppressed? ... View more