Dashboards & Visualizations
Highlighted

How to remove "All time" and "Real time" from one dashboard's timepicker

Contributor

While building dashboards and having the timepicker in the dashboard, I need to find a way to remove "All time" and "Real time". Is there a way to just add a line of code in the XML?

0 Karma
Highlighted

Re: How to remove "All time" and "Real time" from one dashboard's timepicker

Champion

The best way to do this is not to remove it from the UI, but to change your user permission. Thought I would probably create a custom role.

On your search heads create authorize.conf within an app or system/local directory.

[rolelimiteduser]
changeownpassword = enabled
embedreport = enabled
get
metadata = enabled
gettypeahead = enabled
input
file = enabled
listdeploymentclient = enabled
listforwarders = enabled
list
inputs = enabled
outputfile = enabled
request
remotetok = enabled
rest
appsview = enabled
rest
propertiesget = enabled
run
debugcommands = enabled
search = enabled
schedule
search = enabled
# this settings limited there maxium search window below is two weeks in seconds
srchTimeWin = 1209600
#leave this capabilility commented out
#rtsearch = enabled

Additionally you can set the UI time picker to defaults from $SPLUNK_HOME/etc/system/local/ui-prefs.conf. Below sets the default to 15m and fast mode when the search window loads for all users.

[default]
dispatch.earliesttime = -15m
dispatch.latest
time = now
display.page.search.mode = fast

I do recommend creating a new roles.

Highlighted

Re: How to remove "All time" and "Real time" from one dashboard's timepicker

Path Finder

It works, but for all timepicker while logged in as role(admin)
What if i have to do for only one dashboard timepicker??

0 Karma
Highlighted

Re: How to remove "All time" and "Real time" from one dashboard's timepicker

Champion

Create a custom timepicker.

0 Karma