topic Dashboard with input for time range OR report in Dashboards & Visualizations

Dashboard with input for time range OR report

jrich523 — Wed, 20 Nov 2013 19:42:10 GMT

I have a simple dashboard that currently uses the FieldSet with an Input of Time, which gives the normal time selection.

Is it possible to define the options there (I dont want users being able to do anything more than 4 hours)

I'd also like to be able to grab reports so they could pick from
15 min
60 min
4 hours
Yesterday (populated via a report that runs nightly)
This Week (report based as well)

Is this possible or would i have to do two different dashboards?

Re: Dashboard with input for time range OR report

dmaislin_splunk — Wed, 20 Nov 2013 20:31:12 GMT

You would need to add a times.conf file in local and disable all of the other default times that come with Splunk. http://docs.splunk.com/Documentation/Splunk/6.0/Admin/Timesconf. This would need to be in your custom app too.

Re: Dashboard with input for time range OR report

jrich523 — Wed, 20 Nov 2013 20:33:57 GMT

So it looks like i can use that to control the time ranges, but how about reports?

Re: Dashboard with input for time range OR report

dmaislin_splunk — Wed, 20 Nov 2013 21:01:26 GMT

It should work across all views and reports in the app.

Re: Dashboard with input for time range OR report

dmaislin_splunk — Wed, 20 Nov 2013 21:05:22 GMT

You should also consider creating access-controls with roles whereas you automatically limit the user that logs into a 4 hour max search window.

Re: Dashboard with input for time range OR report

jrich523 — Wed, 20 Nov 2013 21:15:21 GMT

So, i cant really mix it on a single view? I have to create a nav menu that has live data (15min-4hour) and a report view?

Re: Dashboard with input for time range OR report

dmaislin_splunk — Wed, 20 Nov 2013 21:19:40 GMT

Nav menu has nothing to do with the time. Only the searches and dashboards that run searches use the times.conf file where you can have a time range picker or the default search time picker on the right. Both will display only the time window you define. I am not sure at this point that I understand clearly what you are trying to do.

Re: Dashboard with input for time range OR report

jrich523 — Wed, 20 Nov 2013 21:25:34 GMT

I want to mix live data and reports. So for the timeconf id want something like
15 min (live)
60 min (live)
4 hour (live)
yesterday (report)
this week (report)

so i'd be trying to have one view (dashboard) that showed either live OR report data, depending on the selection in the drop down. basically i dont want to have to create the dashboard twice when it will be the same layout, just different source

Re: Dashboard with input for time range OR report

dmaislin_splunk — Wed, 20 Nov 2013 21:31:08 GMT

Which version of Splunk? In XML you can just add time params.

My Saved Search Name

True
Last 15 minutes

Re: Dashboard with input for time range OR report

jrich523 — Wed, 20 Nov 2013 23:13:43 GMT

Sorry, should have mentioned that in the post, its version 6. I'll look at the hiddensavedsearches though