I need to disable "All time" from the TimeRangePicker. My customers are not paying attention and all too often run a search for "All time". Then they complain that the search never finishes.
I have modified times.conf and have looked at the TimeRangePicker.js but can't figure out how to disable "All time".
My preference is for the default to be "Today" system wide.
Try looking here,
Manager -> User Interface -> Time Ranges
you should be able to disable 'all time' and set a low number on priority for 'today'.
Haven't tried it though.
We have numerous customized times.conf based on teh requirement of the dashboard. None have "All time". That is not an entry in any .conf that I can find.
The problem is a new user will always get the default "all time" before he changed the timerage-picker the first time, and splunk sotres the last selected value per user.
I changed the flashtimeline-dashboard in the search app (goto Manager » User interface » Views) and edited as follow:
< module name="TimeRangePicker">< param name="selected">All time< /param>
< module name="TimeRangePicker">< param name="selected">Last 15 minutes< /param>
This will change the default value to "Last 15 minutes"
Note: Ignore the spaces after < in the code-blocks, its just because of autoformat in this text-box.
Because I have over 50 dashboards with over 500 views, many with TimeRangePickers, it will take a lot of work to do that. Future dashboards can get that edit.
The bigger problem for me is that this is a DoD site. that means that I will have to submit to committee an ECP for each view that needs to be edited, and then wait a month while the commieett works its way thorugh it. I'll be retired before then.
I understand. Are you running Splunk on linux? If so, what about a script changing all the TimeRangePicker parameters directly in the XML, after a restart the changes would be applied. You can use tools like sed or awk for this task.
A other way - which is just an idea by my self - would be to edit the viewstates of the users and change the value of the TimeRangePicker here ...
Also, I could not find the spec file showing the possible values to disable all_time but the configuration would as follows in times.conf:
[all_time] disabled = 1
(not, disabled = true)
To turn All-time off in the menu, edit the flashtimeline view:
#<list> #<param name="text">All</param> #<param name="value">0</param> #</list>
Alternative: edit etc/system/local/authorize.conf and add to any role:
This will maximize all-time to 12345 seconds ago. Your users won't complain about long search time 😉