Limiting date/time selector to any range with maximum of x hours.

[kennsche]

Hello everyone, I am using Splunk Studio to create a dashboard with two tabs. Enterprise version 9.4.1.

Both tabs are visually identical but in tab 1, I am quering summarized indexes whereas for the second tab, I am running normal queries. 'Normal' queries in this tab can be very intensive if a long time range is selected, therefore, I am trying to limit the time selection to a maximum range of two hours. It could be in any day but the duration between start and end time should not exceed 2 hours. (Not latest 2hours)

I've tried editing XML by following some AI suggestions. Most suggestions relied on changing the query itself but this was breaking the query and returning no results in the end.

Wondering if someone has already any insights how to do this or could guide me in the right direction?

Visually it would look like this:

[kennsche]

Hi @gcusello thanks for the suggestion!

Since I have two tabs, would the role approach be granular enough to limit the search to one tab within the same dashboard? The other tab should not be limited.

Regards
Kenny

[gcusello]

Hi @kennsche ,

the role limitations are for all searches and dashboards.

So you could create a role with the time window limitation, assigning this role some of your users and enable to use the dashboard only that role.

Otherwise, the only solution is to create a list of possible time periods (e.g. 5m, 10m, 15m, 30m, 60m 90m, 120m) and display it in a dropdown list.

But this solution is applicable only to a dashboard, not to search.

Ciao.

Giuseppe

[gcusello]

Hi @kennsche ,

in [Settings > User interface > Time ranges] you can define the time ranges that a role finds in the default choices, but you don't limit the possibility to have a larger time period.

So the most efficient way to really limit the time period in searches, is to create a role dedicated to your users and then add a limit in [Settings > Roles > Click on role > Resources > Role search time window limit].

Ciao.

Giuseppe