topic Re: Disable "All time" in Dashboards & Visualizations

Disable "All time"

kmattern — Fri, 15 Mar 2013 14:38:55 GMT

I need to disable "All time" from the TimeRangePicker. My customers are not paying attention and all too often run a search for "All time". Then they complain that the search never finishes.

I have modified times.conf and have looked at the TimeRangePicker.js but can't figure out how to disable "All time".

My preference is for the default to be "Today" system wide.

Re: Disable "All time"

kristian_kolb — Fri, 15 Mar 2013 14:53:36 GMT

Try looking here,

Manager -> User Interface -> Time Ranges

you should be able to disable 'all time' and set a low number on priority for 'today'.

Haven't tried it though.

Re: Disable "All time"

kmattern — Fri, 15 Mar 2013 15:26:34 GMT

It just defaulted to "over all time", no improvement there!

Re: Disable "All time"

kristian_kolb — Fri, 15 Mar 2013 15:42:17 GMT

I could disable the 'all time'.

times.conf indeed. No overriding conf in a file with higher precedence?

Re: Disable "All time"

christian_l — Fri, 15 Mar 2013 16:09:01 GMT

The problem is a new user will always get the default "all time" before he changed the timerage-picker the first time, and splunk sotres the last selected value per user.
I changed the flashtimeline-dashboard in the search app (goto Manager » User interface » Views) and edited as follow:

Old (default):

< module name="TimeRangePicker">< param name="selected">All time< /param>

New:

< module name="TimeRangePicker">< param name="selected">Last 15 minutes< /param>

This will change the default value to "Last 15 minutes"
Note: Ignore the spaces after < in the code-blocks, its just because of autoformat in this text-box.

Re: Disable "All time"

kmattern — Fri, 15 Mar 2013 16:38:20 GMT

Because I have over 50 dashboards with over 500 views, many with TimeRangePickers, it will take a lot of work to do that. Future dashboards can get that edit.

The bigger problem for me is that this is a DoD site. that means that I will have to submit to committee an ECP for each view that needs to be edited, and then wait a month while the commieett works its way thorugh it. I'll be retired before then.

Re: Disable "All time"

kmattern — Fri, 15 Mar 2013 16:39:50 GMT

We have numerous customized times.conf based on teh requirement of the dashboard. None have "All time". That is not an entry in any .conf that I can find.

Re: Disable "All time"

christian_l — Tue, 19 Mar 2013 15:55:20 GMT

I understand. Are you running Splunk on linux? If so, what about a script changing all the TimeRangePicker parameters directly in the XML, after a restart the changes would be applied. You can use tools like sed or awk for this task.

A other way - which is just an idea by my self - would be to edit the viewstates of the users and change the value of the TimeRangePicker here ...

Re: Disable "All time"

the_wolverine — Tue, 12 Nov 2013 21:10:06 GMT

Also, I could not find the spec file showing the possible values to disable all_time but the configuration would as follows in times.conf:

[all_time]
disabled = 1

(not, disabled = true)

Re: Disable "All time"

tweaktubbie — Wed, 07 Oct 2015 12:34:18 GMT

To turn All-time off in the menu, edit the flashtimeline view:

#<list>
#<param name="text">All</param>
#<param name="value">0</param>
#</list>

Alternative: edit etc/system/local/authorize.conf and add to any role:
srchTimeWin=12345

This will maximize all-time to 12345 seconds ago. Your users won't complain about long search time 😉

Re: Disable "All time"

enno — Tue, 05 Jun 2018 04:29:10 GMT

Nice tip on srchTimeWin... Let's me give the masses more sensible limits but also allow power users more flexibility on a role by role basis. Thanks.