Dashboard with input for time range OR report

[jrich523]

I have a simple dashboard that currently uses the FieldSet with an Input of Time, which gives the normal time selection.

Is it possible to define the options there (I dont want users being able to do anything more than 4 hours)

I'd also like to be able to grab reports so they could pick from
15 min
60 min
4 hours
Yesterday (populated via a report that runs nightly)
This Week (report based as well)

Is this possible or would i have to do two different dashboards?

[dmaislin_splunk]

You would need to add a times.conf file in local and disable all of the other default times that come with Splunk. http://docs.splunk.com/Documentation/Splunk/6.0/Admin/Timesconf. This would need to be in your custom app too.

[jrich523]

Sorry, should have mentioned that in the post, its version 6. I'll look at the hiddensavedsearches though

[dmaislin_splunk]

Which version of Splunk? In XML you can just add time params.

[jrich523]

I want to mix live data and reports. So for the timeconf id want something like
15 min (live)
60 min (live)
4 hour (live)
yesterday (report)
this week (report)

so i'd be trying to have one view (dashboard) that showed either live OR report data, depending on the selection in the drop down. basically i dont want to have to create the dashboard twice when it will be the same layout, just different source

[dmaislin_splunk]

Nav menu has nothing to do with the time. Only the searches and dashboards that run searches use the times.conf file where you can have a time range picker or the default search time picker on the right. Both will display only the time window you define. I am not sure at this point that I understand clearly what you are trying to do.

[jrich523]

So, i cant really mix it on a single view? I have to create a nav menu that has live data (15min-4hour) and a report view?

[dmaislin_splunk]

You should also consider creating access-controls with roles whereas you automatically limit the user that logs into a 4 hour max search window.

[dmaislin_splunk]

It should work across all views and reports in the app.

[jrich523]

So it looks like i can use that to control the time ranges, but how about reports?