Can we give a predefined time for the time picker control ??

[rakesh_498115]

Hi .

Can i give the default values for the splunk timepicker control ?? . or is it possible to disable last 30 days and alltime ,other and custom time options in the available timepicker control.. ???

Please help .thnx..

[alacercogitatus · Accepted solution]

I know you can create custom time ranges but not sure about removing them. I'll look deeper in a bit

times.conf

[alacercogitatus]

Why, thank you piebob!

[piebob]

for your patience, i accepted your answer alacer 🙂

[alacercogitatus]

The default is in $SPLUNK_HOME/etc/system/default/times.conf. You will want to copy that to $SPLUNK_HOME/etc/system/local/times.conf and make your changes there. If your question has been satisfactorily answered, please accept the answer.

[rakesh_498115]

ok thank you so much for info ..where will be the default times.conf file then ??

[sowings]

To disable all of the defaults (you'd have to provide your own full list), use

[default]
disabled = True

To just disable a single one of the defaults, replace its disabled flag in your own copy of times.conf by creating a matching stanza, then setting disabled = true:

[last_30_days]
disabled = True

Your own times.conf should go in the local/ subfolder of your custom app.

[alacercogitatus]

Well, from the documentation, for 30 minutes you'd have a stanza such as:

[last_30_minutes]
label = Last 30 minutes
header_label = in the last 30 minutes
earliest_time = -30m

You would change this stanza to match what times you want. Please see the times.conf documentation for more information. I don't see a way to remove them.

[rakesh_498115]

Hi..

Can i have an example for this please ..I need the following times to be used with the timepicker ..

last 30 min
last 60 min
last 24 hrs
last 7 days
last 10 days

how can i define them .. Once you gone through the documention..can you please post a answer for my question ..