Dashboards & Visualizations

Dashboard with input for time range OR report

Path Finder

I have a simple dashboard that currently uses the FieldSet with an Input of Time, which gives the normal time selection.

Is it possible to define the options there (I dont want users being able to do anything more than 4 hours)

I'd also like to be able to grab reports so they could pick from
15 min
60 min
4 hours
Yesterday (populated via a report that runs nightly)
This Week (report based as well)

Is this possible or would i have to do two different dashboards?

Tags (3)
0 Karma

Splunk Employee
Splunk Employee

You would need to add a times.conf file in local and disable all of the other default times that come with Splunk. http://docs.splunk.com/Documentation/Splunk/6.0/Admin/Timesconf. This would need to be in your custom app too.

Path Finder

Sorry, should have mentioned that in the post, its version 6. I'll look at the hiddensavedsearches though

0 Karma

Splunk Employee
Splunk Employee

Which version of Splunk? In XML you can just add time params.


My Saved Search Name

True
Last 15 minutes


0 Karma

Path Finder

I want to mix live data and reports. So for the timeconf id want something like
15 min (live)
60 min (live)
4 hour (live)
yesterday (report)
this week (report)

so i'd be trying to have one view (dashboard) that showed either live OR report data, depending on the selection in the drop down. basically i dont want to have to create the dashboard twice when it will be the same layout, just different source

0 Karma

Splunk Employee
Splunk Employee

Nav menu has nothing to do with the time. Only the searches and dashboards that run searches use the times.conf file where you can have a time range picker or the default search time picker on the right. Both will display only the time window you define. I am not sure at this point that I understand clearly what you are trying to do.

0 Karma

Path Finder

So, i cant really mix it on a single view? I have to create a nav menu that has live data (15min-4hour) and a report view?

0 Karma

Splunk Employee
Splunk Employee

You should also consider creating access-controls with roles whereas you automatically limit the user that logs into a 4 hour max search window.

0 Karma

Splunk Employee
Splunk Employee

It should work across all views and reports in the app.

0 Karma

Path Finder

So it looks like i can use that to control the time ranges, but how about reports?

0 Karma