Dashboards & Visualizations

TimeRangePicker - Custom values

sranga
Path Finder

Hi

I was wondering if its possible to only display a subset of the values provided by the TimeRangePicker. Each dashboard could display its own subset of values.

For instance, I want to display just the "Last 60 minutes", "Last 24 hours" and "Last 7 days" on one dashboard and "Month to date" and "Year to date" on a different dashboard.

Thanks.

Ranga

1 Solution

southeringtonp
Motivator

I don't believe that it possible to do this with TimeRangePicker directly. The cleanest solution is just to live with that limitation.


If you really need this functionality, you could remove the TimeRangePicker altogether, and just create multiple dashboards. This may be practical if the number is kept small. Then you can set the time range explicitly in the searches for each dashboard:

<module name="HiddenSearch">
    <param name="earliest">-24h</param>
    <param name="search">host=XXX termXXX</param>
    <!-- Child modules go here -->
</module>

If doing this, you can also modify the nav.xml file to organize each group of similar dashboards into a single menu / submenu.


If you really need to have this selectable, one possible workaround would be to use a StaticSelect and ConvertToIntention modules to do string replacement in the search string - it would look something like this:

<module name="StaticSelect" layoutPanel="splSearchControls-inline">
<param name="settingToCreate">timerange_setting</param>
<param name="staticFieldsToDisplay">
  <list>
    <param name="label">Last 60 Minutes</param>
    <param name="value">earliest=-1h</param>
  </list>
  <list>
    <param name="label">Last 24 Hours</param>
    <param name="value">earliest=-24h</param>
  </list>
  <list>
    <param name="label">Last 7 Days</param>
    <param name="value">earliest=-7d</param>
  </list>
</param>
<param name="label">Time Range:</param>
<module name="ConvertToIntention">
  <param name="settingToConvert">timerange_setting</param>
  <param name="intention">
    <param name="name">stringreplace</param>
    <param name="arg">
      <param name="timeFilter">
        <param name="value">$target$</param>
      </param>
    </param>
  </param>
  <param name="preserveParentIntentions">true</param>
  <module name="HiddenSearch" layoutPanel="panel_row1_col1" autoRun="True">
    <param name="search">$timeRange$ host=XXX termXXX</param>
    <!-- Child modules go here -->
</module>

View solution in original post

koshyk
Super Champion

Shame we can't override this in "<input type="time" " code
Alternatively, you could use "sideview Utils" which has option to provide custom time.

0 Karma

southeringtonp
Motivator

I don't believe that it possible to do this with TimeRangePicker directly. The cleanest solution is just to live with that limitation.


If you really need this functionality, you could remove the TimeRangePicker altogether, and just create multiple dashboards. This may be practical if the number is kept small. Then you can set the time range explicitly in the searches for each dashboard:

<module name="HiddenSearch">
    <param name="earliest">-24h</param>
    <param name="search">host=XXX termXXX</param>
    <!-- Child modules go here -->
</module>

If doing this, you can also modify the nav.xml file to organize each group of similar dashboards into a single menu / submenu.


If you really need to have this selectable, one possible workaround would be to use a StaticSelect and ConvertToIntention modules to do string replacement in the search string - it would look something like this:

<module name="StaticSelect" layoutPanel="splSearchControls-inline">
<param name="settingToCreate">timerange_setting</param>
<param name="staticFieldsToDisplay">
  <list>
    <param name="label">Last 60 Minutes</param>
    <param name="value">earliest=-1h</param>
  </list>
  <list>
    <param name="label">Last 24 Hours</param>
    <param name="value">earliest=-24h</param>
  </list>
  <list>
    <param name="label">Last 7 Days</param>
    <param name="value">earliest=-7d</param>
  </list>
</param>
<param name="label">Time Range:</param>
<module name="ConvertToIntention">
  <param name="settingToConvert">timerange_setting</param>
  <param name="intention">
    <param name="name">stringreplace</param>
    <param name="arg">
      <param name="timeFilter">
        <param name="value">$target$</param>
      </param>
    </param>
  </param>
  <param name="preserveParentIntentions">true</param>
  <module name="HiddenSearch" layoutPanel="panel_row1_col1" autoRun="True">
    <param name="search">$timeRange$ host=XXX termXXX</param>
    <!-- Child modules go here -->
</module>

samsplunkd
Path Finder

Any idea how this can be achieved for "Custom time..." in TimeRangePicker?

sranga
Path Finder

Thanks. Yes, this solution is what I was contemplating as well 🙂

0 Karma

adamw
Communicator

These are defined in etc/system/default/times.conf

You should probably copy this file to etc/system/local/times.conf and edit it there, so that you don't get screwed when you upgrade.

sranga
Path Finder

Thanks. Wouldn't this would affect the time-values displayed on all the dashboards/charts? The requirement is for each dashboard to display whatever time-values are appropriate for it. I've edited my post to include the per-dashboard subset of values criteria.

Get Updates on the Splunk Community!

Splunk Enterprise Security: Your Command Center for PCI DSS Compliance

Every security professional knows the drill. The PCI DSS audit is approaching, and suddenly everyone's asking ...

Developer Spotlight with Guilhem Marchand

From Splunk Engineer to Founder: The Journey Behind TrackMe    After spending over 12 years working full time ...

Cisco Catalyst Center Meets Splunk ITSI: From 'Payments Are Down' to Root Cause in ...

The Problem: When Networks and Services Don't Talk Payment systems fail at a retail location. Customers are ...