Splunk Ignoring </param>'s in Dashboard

[pl123]

Hi im working on developing a large advanced-xml dashboard. It appears splunk in some stanza's is ignoring some params.

For example

 ....
 ....
 <module name="HiddenSearch"> 
                  <module name="TimeRangePicker">
                    <param name="default">Last 24 hours</param>
                    <param name="searchWhenChanged">True</param>
                    <module name="HiddenSearch" autoRun="False">
                      ...
                      <module name="SubmitButton">
                        ...
                        <module name="Message" layoutPanel="graphArea">
                          ...
                          <module name="JobStatus">
                            ...
                            <module name="FlashTimeline" layoutPanel="graphArea">
                               ...
                                ...

Results in the gui time range picker still defaulting to "all time" even though it is set to 24 hours. Is there anyway to force it a particular time range, as the doc says is possible?

We are running 4.1.6, and I am editing the files from the manager. I can post the entire dash if it would help anyone (300+ lines)

Cheers

[sideview · Accepted solution]

This is a common point of confusion. Unfortunately the 'default' param of the TimeRangePicker has no effect once you make a different selection. Once you change it away from 'Last 24 Hours', the change is persisted in a 'viewstate', and for that Splunk user, the modified version becomes the effective default.

You can disable the stickiness of all elements in the view by placing 'isSticky="False"' into the <view> tag. This works fine if nobody has ever used the view. HOWEVER if users have already used the view, it's a different story. Unfortunately turning off the stickiness only disables subsequent changes to that stickiness - it doesnt wipe away previously 'stuck' changes. So if you put isSticky="False" into the view right now, your user account would be doomed to have 'All Time' selected by default permanently.

So, if people have already used the view, you'll also have to comb through all the viewstate stanzas in /etc/users/<username> and remove all the relevant viewstates.

Update: I just noticed that I've answered this question a couple other times too:

http://answers.splunk.com/questions/9127/timerangepicker

http://answers.splunk.com/questions/9741/timerangepicker-wont-hold-value-on-dashboard