Dashboards & Visualizations
Highlighted

Disable "All time"

Builder

I need to disable "All time" from the TimeRangePicker. My customers are not paying attention and all too often run a search for "All time". Then they complain that the search never finishes.

I have modified times.conf and have looked at the TimeRangePicker.js but can't figure out how to disable "All time".

My preference is for the default to be "Today" system wide.

Highlighted

Re: Disable "All time"

Ultra Champion

Try looking here,

Manager -> User Interface -> Time Ranges

you should be able to disable 'all time' and set a low number on priority for 'today'.

Haven't tried it though.

/K

0 Karma
Highlighted

Re: Disable "All time"

Builder

It just defaulted to "over all time", no improvement there!

0 Karma
Highlighted

Re: Disable "All time"

Ultra Champion

I could disable the 'all time'.

times.conf indeed. No overriding conf in a file with higher precedence?

0 Karma
Highlighted

Re: Disable "All time"

Builder

We have numerous customized times.conf based on teh requirement of the dashboard. None have "All time". That is not an entry in any .conf that I can find.

0 Karma
Highlighted

Re: Disable "All time"

Path Finder

The problem is a new user will always get the default "all time" before he changed the timerage-picker the first time, and splunk sotres the last selected value per user.
I changed the flashtimeline-dashboard in the search app (goto Manager » User interface » Views) and edited as follow:

Old (default):

< module name="TimeRangePicker">< param name="selected">All time< /param>

New:

< module name="TimeRangePicker">< param name="selected">Last 15 minutes< /param>

This will change the default value to "Last 15 minutes"
Note: Ignore the spaces after < in the code-blocks, its just because of autoformat in this text-box.

0 Karma
Highlighted

Re: Disable "All time"

Builder

Because I have over 50 dashboards with over 500 views, many with TimeRangePickers, it will take a lot of work to do that. Future dashboards can get that edit.

The bigger problem for me is that this is a DoD site. that means that I will have to submit to committee an ECP for each view that needs to be edited, and then wait a month while the commieett works its way thorugh it. I'll be retired before then.

0 Karma
Highlighted

Re: Disable "All time"

Path Finder

I understand. Are you running Splunk on linux? If so, what about a script changing all the TimeRangePicker parameters directly in the XML, after a restart the changes would be applied. You can use tools like sed or awk for this task.

A other way - which is just an idea by my self - would be to edit the viewstates of the users and change the value of the TimeRangePicker here ...

0 Karma
Highlighted

Re: Disable "All time"

Champion

Also, I could not find the spec file showing the possible values to disable all_time but the configuration would as follows in times.conf:

[all_time]
disabled = 1

(not, disabled = true)

View solution in original post

Highlighted

Re: Disable "All time"

Communicator

To turn All-time off in the menu, edit the flashtimeline view:

#<list>
#<param name="text">All</param>
#<param name="value">0</param>
#</list>

Alternative: edit etc/system/local/authorize.conf and add to any role:
srchTimeWin=12345

This will maximize all-time to 12345 seconds ago. Your users won't complain about long search time 😉