topic Re: Custom times.conf in Dashboards & Visualizations

Custom times.conf

Brian_Osburn — Fri, 03 Sep 2010 06:41:32 GMT

In this app I'm working on, I would like to restrict what the users can select from the time range picker.

Specifically, I'm looking to remove the real time and all time options. In addition, I am re-ordering some of the items.

I copied $SPLUNK_HOME/etc/system/default/times.conf to $SPLUNK_HOME/etc/apps/$app_name/system/default and modified it.

Running ./splunk cmd btool times list --debug shows it picking up the configuration from the app specific times.conf. Unfortunately, in the advanced xml dashboard I'm working on that has the TimeRangePicker but still shows the standard time dropdowns.

Any ideas?

Re: Custom times.conf

gkanapathy — Fri, 03 Sep 2010 07:16:57 GMT

Update: According to another answer by caphrim007 that there is a disabled = true option that is not documented (as of 4.1.5), but available in 4.1.x and up, so the below comments about sub_menu are only relevant for use on 4.0.x.

With all config files, the stanzas in scope are merged by stanza to generate the configuration that is relevant. In the case of times.conf, each time range is a separate stanza, so unless you disable on that is inherited from the system, it will remain.

There is no explicit "disable" option that you can provide in your app to override/disable the inherited. However, an embarrassing workaround is to set:

sub_menu = _non_existent_sub_menu

for each stanza/range that you want removed from your app in your app's times.conf. This will suppress the respective stanza/range as long as there is no sub-menu by that name.

Regarding btool, you should use the --app=myapp option to see the effective configuration file for your app.

Re: Custom times.conf

Brian_Osburn — Fri, 03 Sep 2010 19:10:53 GMT

I like that - "embarrassing work around".

I recopied the times.conf over, modified it so that the pre-set time ranges were set to a non existant sub menu.

Unfortunately the "Custom Time" range is still available, and sub-menu's are still visible even if they don't have any time ranges under them.

I'm thinking this may have to be changed into an enhancement request - seems like we need to have more control over the "TimeRangePicker" module.

Re: Custom times.conf

gkanapathy — Fri, 03 Sep 2010 21:07:50 GMT

I think you can get rid of a sub menu by setting it's sub menu property to a non existent sub menu as well, but I don't know if there's a way to turn off the "custom time" option. I had a bug filed on this and it is marked "fixed", so perhaps you can use "disabled = true" or "enabled = false" and it's just not documented.

Re: Custom times.conf

caphrim007 — Mon, 13 Sep 2010 21:48:35 GMT

I can verify what gkanapathy said about "disabled = true"


[real_time_menu]
disabled = true

[other]
disabled = true

works to remove the "Other" and "Real-time" menus from the TimeRangePicker if you add them to a times.conf in your app's default or local directory. Using splunk 4.1.4

Re: Custom times.conf

helge — Sun, 02 Dec 2012 00:21:29 GMT

In 5.0.1 "disabled=true" is still not documented, but it works for all stanzas.

Re: Custom times.conf

jpenetra — Mon, 28 Sep 2020 15:20:13 GMT

Is this still available on splunk 6.0? I've created the times.conf file on the default folder of my app and the real_time_menu and the other menu still appear.

Re: Custom times.conf

mcronkrite — Tue, 05 Aug 2014 14:57:37 GMT

Yes this is still available in 6.0 just confirmed. You may want to checkout btool results, and also verify that you've restarted, and make sure nothing in local of your app is overriding you default.

Re: Custom times.conf

srinathd — Mon, 28 Sep 2020 18:02:22 GMT

[real_time_menu]
disabled=true

is not working. still it is showing the real time menu in time range picker