Dashboards & Visualizations

TimeRangePicker - Custom values

sranga
Path Finder

Hi

I was wondering if its possible to only display a subset of the values provided by the TimeRangePicker. Each dashboard could display its own subset of values.

For instance, I want to display just the "Last 60 minutes", "Last 24 hours" and "Last 7 days" on one dashboard and "Month to date" and "Year to date" on a different dashboard.

Thanks.

Ranga

1 Solution

southeringtonp
Motivator

I don't believe that it possible to do this with TimeRangePicker directly. The cleanest solution is just to live with that limitation.


If you really need this functionality, you could remove the TimeRangePicker altogether, and just create multiple dashboards. This may be practical if the number is kept small. Then you can set the time range explicitly in the searches for each dashboard:

<module name="HiddenSearch">
    <param name="earliest">-24h</param>
    <param name="search">host=XXX termXXX</param>
    <!-- Child modules go here -->
</module>

If doing this, you can also modify the nav.xml file to organize each group of similar dashboards into a single menu / submenu.


If you really need to have this selectable, one possible workaround would be to use a StaticSelect and ConvertToIntention modules to do string replacement in the search string - it would look something like this:

<module name="StaticSelect" layoutPanel="splSearchControls-inline">
<param name="settingToCreate">timerange_setting</param>
<param name="staticFieldsToDisplay">
  <list>
    <param name="label">Last 60 Minutes</param>
    <param name="value">earliest=-1h</param>
  </list>
  <list>
    <param name="label">Last 24 Hours</param>
    <param name="value">earliest=-24h</param>
  </list>
  <list>
    <param name="label">Last 7 Days</param>
    <param name="value">earliest=-7d</param>
  </list>
</param>
<param name="label">Time Range:</param>
<module name="ConvertToIntention">
  <param name="settingToConvert">timerange_setting</param>
  <param name="intention">
    <param name="name">stringreplace</param>
    <param name="arg">
      <param name="timeFilter">
        <param name="value">$target$</param>
      </param>
    </param>
  </param>
  <param name="preserveParentIntentions">true</param>
  <module name="HiddenSearch" layoutPanel="panel_row1_col1" autoRun="True">
    <param name="search">$timeRange$ host=XXX termXXX</param>
    <!-- Child modules go here -->
</module>

View solution in original post

koshyk
Super Champion

Shame we can't override this in "<input type="time" " code
Alternatively, you could use "sideview Utils" which has option to provide custom time.

0 Karma

southeringtonp
Motivator

I don't believe that it possible to do this with TimeRangePicker directly. The cleanest solution is just to live with that limitation.


If you really need this functionality, you could remove the TimeRangePicker altogether, and just create multiple dashboards. This may be practical if the number is kept small. Then you can set the time range explicitly in the searches for each dashboard:

<module name="HiddenSearch">
    <param name="earliest">-24h</param>
    <param name="search">host=XXX termXXX</param>
    <!-- Child modules go here -->
</module>

If doing this, you can also modify the nav.xml file to organize each group of similar dashboards into a single menu / submenu.


If you really need to have this selectable, one possible workaround would be to use a StaticSelect and ConvertToIntention modules to do string replacement in the search string - it would look something like this:

<module name="StaticSelect" layoutPanel="splSearchControls-inline">
<param name="settingToCreate">timerange_setting</param>
<param name="staticFieldsToDisplay">
  <list>
    <param name="label">Last 60 Minutes</param>
    <param name="value">earliest=-1h</param>
  </list>
  <list>
    <param name="label">Last 24 Hours</param>
    <param name="value">earliest=-24h</param>
  </list>
  <list>
    <param name="label">Last 7 Days</param>
    <param name="value">earliest=-7d</param>
  </list>
</param>
<param name="label">Time Range:</param>
<module name="ConvertToIntention">
  <param name="settingToConvert">timerange_setting</param>
  <param name="intention">
    <param name="name">stringreplace</param>
    <param name="arg">
      <param name="timeFilter">
        <param name="value">$target$</param>
      </param>
    </param>
  </param>
  <param name="preserveParentIntentions">true</param>
  <module name="HiddenSearch" layoutPanel="panel_row1_col1" autoRun="True">
    <param name="search">$timeRange$ host=XXX termXXX</param>
    <!-- Child modules go here -->
</module>

samsplunkd
Path Finder

Any idea how this can be achieved for "Custom time..." in TimeRangePicker?

sranga
Path Finder

Thanks. Yes, this solution is what I was contemplating as well 🙂

0 Karma

adamw
Communicator

These are defined in etc/system/default/times.conf

You should probably copy this file to etc/system/local/times.conf and edit it there, so that you don't get screwed when you upgrade.

sranga
Path Finder

Thanks. Wouldn't this would affect the time-values displayed on all the dashboards/charts? The requirement is for each dashboard to display whatever time-values are appropriate for it. I've edited my post to include the per-dashboard subset of values criteria.

Get Updates on the Splunk Community!

Splunkers, Pack Your Bags: Why Cisco Live EMEA is Your Next Big Destination

The Power of Two: Splunk &#43; Cisco at "Ludicrous Scale"   You know Splunk. You know Cisco. But have you seen ...

Data Management Digest – January 2026

Welcome to the January 2026 edition of Data Management Digest! Welcome to the January 2026 edition of Data ...

Splunk SOAR Now Available on Google Cloud Platform

We’re excited to announce that Splunk SOAR is now natively available as a SaaS solution on Google Cloud ...