Custom times.conf

[Brian_Osburn]

In this app I'm working on, I would like to restrict what the users can select from the time range picker.

Specifically, I'm looking to remove the real time and all time options. In addition, I am re-ordering some of the items.

I copied $SPLUNK_HOME/etc/system/default/times.conf to $SPLUNK_HOME/etc/apps/$app_name/system/default and modified it.

Running ./splunk cmd btool times list --debug shows it picking up the configuration from the app specific times.conf. Unfortunately, in the advanced xml dashboard I'm working on that has the TimeRangePicker but still shows the standard time dropdowns.

Any ideas?

[caphrim007]

I can verify what gkanapathy said about "disabled = true"

[real_time_menu]
disabled = true

[other]
disabled = true

works to remove the "Other" and "Real-time" menus from the TimeRangePicker if you add them to a times.conf in your app's default or local directory. Using splunk 4.1.4

[srinathd]

[real_time_menu]
disabled=true

is not working. still it is showing the real time menu in time range picker

[mcronkrite]

Yes this is still available in 6.0 just confirmed. You may want to checkout btool results, and also verify that you've restarted, and make sure nothing in local of your app is overriding you default.

[jpenetra]

Is this still available on splunk 6.0? I've created the times.conf file on the default folder of my app and the real_time_menu and the other menu still appear.

[helge]

In 5.0.1 "disabled=true" is still not documented, but it works for all stanzas.

[gkanapathy · Accepted solution]

Update: According to another answer by caphrim007 that there is a disabled = true option that is not documented (as of 4.1.5), but available in 4.1.x and up, so the below comments about sub_menu are only relevant for use on 4.0.x.

---

With all config files, the stanzas in scope are merged by stanza to generate the configuration that is relevant. In the case of times.conf, each time range is a separate stanza, so unless you disable on that is inherited from the system, it will remain.

There is no explicit "disable" option that you can provide in your app to override/disable the inherited. However, an embarrassing workaround is to set:

sub_menu = _non_existent_sub_menu

for each stanza/range that you want removed from your app in your app's times.conf. This will suppress the respective stanza/range as long as there is no sub-menu by that name.

---

Regarding btool, you should use the --app=myapp option to see the effective configuration file for your app.

[gkanapathy]

I think you can get rid of a sub menu by setting it's sub menu property to a non existent sub menu as well, but I don't know if there's a way to turn off the "custom time" option. I had a bug filed on this and it is marked "fixed", so perhaps you can use "disabled = true" or "enabled = false" and it's just not documented.

[Brian_Osburn]

I like that - "embarrassing work around".

I recopied the times.conf over, modified it so that the pre-set time ranges were set to a non existant sub menu.

Unfortunately the "Custom Time" range is still available, and sub-menu's are still visible even if they don't have any time ranges under them.

I'm thinking this may have to be changed into an enhancement request - seems like we need to have more control over the "TimeRangePicker" module.