Dashboards & Visualizations

Dashboard with input for time range OR report

jrich523
Path Finder

I have a simple dashboard that currently uses the FieldSet with an Input of Time, which gives the normal time selection.

Is it possible to define the options there (I dont want users being able to do anything more than 4 hours)

I'd also like to be able to grab reports so they could pick from
15 min
60 min
4 hours
Yesterday (populated via a report that runs nightly)
This Week (report based as well)

Is this possible or would i have to do two different dashboards?

Tags (3)
0 Karma

dmaislin_splunk
Splunk Employee
Splunk Employee

You would need to add a times.conf file in local and disable all of the other default times that come with Splunk. http://docs.splunk.com/Documentation/Splunk/6.0/Admin/Timesconf. This would need to be in your custom app too.

jrich523
Path Finder

Sorry, should have mentioned that in the post, its version 6. I'll look at the hiddensavedsearches though

0 Karma

dmaislin_splunk
Splunk Employee
Splunk Employee

Which version of Splunk? In XML you can just add time params.


My Saved Search Name

True
Last 15 minutes


0 Karma

jrich523
Path Finder

I want to mix live data and reports. So for the timeconf id want something like
15 min (live)
60 min (live)
4 hour (live)
yesterday (report)
this week (report)

so i'd be trying to have one view (dashboard) that showed either live OR report data, depending on the selection in the drop down. basically i dont want to have to create the dashboard twice when it will be the same layout, just different source

0 Karma

dmaislin_splunk
Splunk Employee
Splunk Employee

Nav menu has nothing to do with the time. Only the searches and dashboards that run searches use the times.conf file where you can have a time range picker or the default search time picker on the right. Both will display only the time window you define. I am not sure at this point that I understand clearly what you are trying to do.

0 Karma

jrich523
Path Finder

So, i cant really mix it on a single view? I have to create a nav menu that has live data (15min-4hour) and a report view?

0 Karma

dmaislin_splunk
Splunk Employee
Splunk Employee

You should also consider creating access-controls with roles whereas you automatically limit the user that logs into a 4 hour max search window.

0 Karma

dmaislin_splunk
Splunk Employee
Splunk Employee

It should work across all views and reports in the app.

0 Karma

jrich523
Path Finder

So it looks like i can use that to control the time ranges, but how about reports?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...