Dashboards & Visualizations

How to define fieldset time earliest/latest in one location for all dashboards in an app?

simpkins1958
Contributor

I have 10+ dashboards in my app. Each dashboard has a fieldset time input with the defaults set for earliest/latest (see screen shot below). All 10+ dashboard need to have the same default values. I would like to set those values in one location, not in each of the XML files. I have tried doing this with macros and ui-prefs.conf with out any luck. Anyone know how I could do this? Thanks.

alt text

0 Karma

somesoni2
SplunkTrust
SplunkTrust

I think you can achieve that using Splunk's Prebuilt Panels feature. Try this

1) Create a Prebuilt panel (Settings -> User Interface -> Prebuilt Panels -> Add new) with following xml). Say you saved it with name TimeRangePickerTemplate

<panel>
  <input type="time" token="timerange">
    <label></label>
    <default>
      <earliest>-60m@m</earliest>
      <latest></latest>
    </default>
  </input>
</panel>

2) Update your dashboards to remove current time range picket that they have, add new prebuilt panel (Edit Panels -> Add Panels ->Prebuilt Panel, see this for more info http://docs.splunk.com/Documentation/Splunk/6.5.0/Viz/AddPanels). Your dashboard should look like this now

<form>
  <label>Test Prebuild Panels</label>
  <fieldset submitButton="false">
     ...other inputs if any...
  </fieldset>
<!--This is the Time range template that you're referencing-->
  <row>
    <panel app="search" ref="TimeRangeTemplate"></panel>
  </row>
...rest of the dashboard...
</form>

You would have to update your dashboard panels to use this time range picket template's token (name: timerange, see the step 1) and you're set. If you want to change the default values, just go and change in the prebuilt panel and it'll get reflected in all dashboards using it.

0 Karma

simpkins1958
Contributor

Thanks. But not going to work for us. The time picker is not part of the filters that can now be hidden in 6.5.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Not sure I understood the reason why it's not going to work.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...