Dashboards & Visualizations

Can I specify only specific items in my advanced dashboard time picker drop down?

nbharadwaj
Path Finder

Version 4.1.1

I am using advanced dashboard with the timerange picker option that is used by all the panels. I want to have a customized timerange picker drop down with only a few items such as:

Last 15 minutes Last 60 minutes Last 4 hours

and not the others.

Is it possible?

thall79
Communicator

Maybe instead of using a TimeRangePicker try using the StaticSelect module.

 <module name="StaticSelect" layoutPanel="panel_row1_col1">
  <param name="settingToCreate">time_setting</param>
  <param name="label">Choose the Time Range</param>
  <param name="selected">-1h</param>
  <param name="searchWhenChanged">True</param>
  <param name="staticFieldsToDisplay">
 <list>
   <param name="label">-1h</param>
   <param name="value">-1h </param>
 </list>
 <list>
   <param name="label">-4h </param>
   <param name="value">-4h </param>
 </list>
 </param>

<module name="ConvertToIntention">
 <param name="settingToConvert">time_setting</param>
 <param name="intention">
 <param name="name">stringreplace</param>
 <param name="arg">
 <param name="time">
 <param name="value">$target$</param>
 </param>
 </param>
 </param>

Then in your hidden search just have earliest=$time$

<module name="HiddenSearch" autoRun="True" layoutPanel="panel_row1_col1">
 <param name="search">(your search) earliest=$time$ | timechart count by User</param>

Hope this helps.

Travis.

Mick
Splunk Employee
Splunk Employee

Yes it is possible, but not striaghtforward.

If you were to reproduce this view in a custom app, then you could simply define a new times.conf within that app containing only the timeranges you want to see. However, that would mean that the TimeRangePicker module in every view inside that app would also be limited.

Another method involves coding specific actions for that module on a per-view basis, which isn't easily done unless you are familiar with the Splunk UI architecture. Our Professional Services team could likely deliver this in about half a day, so if it's something that's critical to your deployment you may want to consider involving theme

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...