topic Re: How to save custom time range for user interface to be used in reports? in Dashboards & Visualizations

How to save custom time range for user interface to be used in reports?

HeinzWaescher — Thu, 14 Aug 2014 13:32:06 GMT

Hi,

I would like to save a custom time range, that can be used in reports.

settings -> user interface -> time ranges:

Name: Test
Label Test

Earliest time: 1406851200
Latest time: @d

Submenu: Other

Spunk complains about the "invalid time: 1406851200". How can I set the earliest time to a specific date? I've already done something like this, but I can't remember how to avoid this error...

Heinz

Re: How to save custom time range for user interface to be used in reports?

martin_mueller — Thu, 14 Aug 2014 13:40:55 GMT

times.conf specifically allows epoch times, so you might just need to edit it there: http://docs.splunk.com/Documentation/Splunk/6.1.3/Admin/timesconf

Alternatively, assuming you only need that custom time range for a limited amount of time, you could write a relative time expression that does the same thing for long enough - in your case you might be looking for @y+7mon to mean "the start of August this year", good until December 31st.

Re: How to save custom time range for user interface to be used in reports?

HeinzWaescher — Fri, 15 Aug 2014 09:54:53 GMT

Editing the times.conf worked fine. But I'm still wondering, how I was able to use a timestamp in the UI some months ago 😉

Thanks!