I have a simple dashboard that currently uses the FieldSet with an Input of Time, which gives the normal time selection.
Is it possible to define the options there (I dont want users being able to do anything more than 4 hours)
I'd also like to be able to grab reports so they could pick from
Yesterday (populated via a report that runs nightly)
This Week (report based as well)
Is this possible or would i have to do two different dashboards?
You would need to add a times.conf file in local and disable all of the other default times that come with Splunk. http://docs.splunk.com/Documentation/Splunk/6.0/Admin/Timesconf. This would need to be in your custom app too.
I want to mix live data and reports. So for the timeconf id want something like
15 min (live)
60 min (live)
4 hour (live)
this week (report)
so i'd be trying to have one view (dashboard) that showed either live OR report data, depending on the selection in the drop down. basically i dont want to have to create the dashboard twice when it will be the same layout, just different source
Nav menu has nothing to do with the time. Only the searches and dashboards that run searches use the times.conf file where you can have a time range picker or the default search time picker on the right. Both will display only the time window you define. I am not sure at this point that I understand clearly what you are trying to do.