Disable "All time"

[kmattern]

I need to disable "All time" from the TimeRangePicker. My customers are not paying attention and all too often run a search for "All time". Then they complain that the search never finishes.

I have modified times.conf and have looked at the TimeRangePicker.js but can't figure out how to disable "All time".

My preference is for the default to be "Today" system wide.

[tweaktubbie]

To turn All-time off in the menu, edit the flashtimeline view:

#<list>
#<param name="text">All</param>
#<param name="value">0</param>
#</list>

Alternative: edit etc/system/local/authorize.conf and add to any role:
srchTimeWin=12345

This will maximize all-time to 12345 seconds ago. Your users won't complain about long search time 😉

[enno]

Nice tip on srchTimeWin... Let's me give the masses more sensible limits but also allow power users more flexibility on a role by role basis. Thanks.

[the_wolverine · Accepted solution]

Also, I could not find the spec file showing the possible values to disable all_time but the configuration would as follows in times.conf:

[all_time]
disabled = 1

(not, disabled = true)

[christian_l]

The problem is a new user will always get the default "all time" before he changed the timerage-picker the first time, and splunk sotres the last selected value per user.
I changed the flashtimeline-dashboard in the search app (goto Manager » User interface » Views) and edited as follow:

Old (default):

< module name="TimeRangePicker">< param name="selected">All time< /param>

New:

< module name="TimeRangePicker">< param name="selected">Last 15 minutes< /param>

This will change the default value to "Last 15 minutes"
Note: Ignore the spaces after < in the code-blocks, its just because of autoformat in this text-box.

[christian_l]

I understand. Are you running Splunk on linux? If so, what about a script changing all the TimeRangePicker parameters directly in the XML, after a restart the changes would be applied. You can use tools like sed or awk for this task.

A other way - which is just an idea by my self - would be to edit the viewstates of the users and change the value of the TimeRangePicker here ...

[kmattern]

Because I have over 50 dashboards with over 500 views, many with TimeRangePickers, it will take a lot of work to do that. Future dashboards can get that edit.

The bigger problem for me is that this is a DoD site. that means that I will have to submit to committee an ECP for each view that needs to be edited, and then wait a month while the commieett works its way thorugh it. I'll be retired before then.

[kristian_kolb]

Try looking here,

Manager -> User Interface -> Time Ranges

you should be able to disable 'all time' and set a low number on priority for 'today'.

Haven't tried it though.

/K

[kmattern]

We have numerous customized times.conf based on teh requirement of the dashboard. None have "All time". That is not an entry in any .conf that I can find.

[kristian_kolb]

I could disable the 'all time'.

times.conf indeed. No overriding conf in a file with higher precedence?

[kmattern]

It just defaulted to "over all time", no improvement there!