Dashboards & Visualizations

Disable "All time"

kmattern
Builder

I need to disable "All time" from the TimeRangePicker. My customers are not paying attention and all too often run a search for "All time". Then they complain that the search never finishes.

I have modified times.conf and have looked at the TimeRangePicker.js but can't figure out how to disable "All time".

My preference is for the default to be "Today" system wide.

1 Solution

the_wolverine
Champion

Also, I could not find the spec file showing the possible values to disable all_time but the configuration would as follows in times.conf:

[all_time]
disabled = 1

(not, disabled = true)

View solution in original post

tweaktubbie
Communicator

To turn All-time off in the menu, edit the flashtimeline view:

#<list>
#<param name="text">All</param>
#<param name="value">0</param>
#</list>

Alternative: edit etc/system/local/authorize.conf and add to any role:
srchTimeWin=12345

This will maximize all-time to 12345 seconds ago. Your users won't complain about long search time 😉

enno
Explorer

Nice tip on srchTimeWin... Let's me give the masses more sensible limits but also allow power users more flexibility on a role by role basis. Thanks.

0 Karma

the_wolverine
Champion

Also, I could not find the spec file showing the possible values to disable all_time but the configuration would as follows in times.conf:

[all_time]
disabled = 1

(not, disabled = true)

christian_l
Path Finder

The problem is a new user will always get the default "all time" before he changed the timerage-picker the first time, and splunk sotres the last selected value per user.
I changed the flashtimeline-dashboard in the search app (goto Manager » User interface » Views) and edited as follow:

Old (default):

< module name="TimeRangePicker">< param name="selected">All time< /param>

New:

< module name="TimeRangePicker">< param name="selected">Last 15 minutes< /param>

This will change the default value to "Last 15 minutes"
Note: Ignore the spaces after < in the code-blocks, its just because of autoformat in this text-box.

0 Karma

christian_l
Path Finder

I understand. Are you running Splunk on linux? If so, what about a script changing all the TimeRangePicker parameters directly in the XML, after a restart the changes would be applied. You can use tools like sed or awk for this task.

A other way - which is just an idea by my self - would be to edit the viewstates of the users and change the value of the TimeRangePicker here ...

0 Karma

kmattern
Builder

Because I have over 50 dashboards with over 500 views, many with TimeRangePickers, it will take a lot of work to do that. Future dashboards can get that edit.

The bigger problem for me is that this is a DoD site. that means that I will have to submit to committee an ECP for each view that needs to be edited, and then wait a month while the commieett works its way thorugh it. I'll be retired before then.

0 Karma

kristian_kolb
Ultra Champion

Try looking here,

Manager -> User Interface -> Time Ranges

you should be able to disable 'all time' and set a low number on priority for 'today'.

Haven't tried it though.

/K

0 Karma

kmattern
Builder

We have numerous customized times.conf based on teh requirement of the dashboard. None have "All time". That is not an entry in any .conf that I can find.

0 Karma

kristian_kolb
Ultra Champion

I could disable the 'all time'.

times.conf indeed. No overriding conf in a file with higher precedence?

0 Karma

kmattern
Builder

It just defaulted to "over all time", no improvement there!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...