Dashboards & Visualizations

TimeRangePicker - Custom values

sranga
Path Finder

Hi

I was wondering if its possible to only display a subset of the values provided by the TimeRangePicker. Each dashboard could display its own subset of values.

For instance, I want to display just the "Last 60 minutes", "Last 24 hours" and "Last 7 days" on one dashboard and "Month to date" and "Year to date" on a different dashboard.

Thanks.

Ranga

1 Solution

southeringtonp
Motivator

I don't believe that it possible to do this with TimeRangePicker directly. The cleanest solution is just to live with that limitation.


If you really need this functionality, you could remove the TimeRangePicker altogether, and just create multiple dashboards. This may be practical if the number is kept small. Then you can set the time range explicitly in the searches for each dashboard:

<module name="HiddenSearch">
    <param name="earliest">-24h</param>
    <param name="search">host=XXX termXXX</param>
    <!-- Child modules go here -->
</module>

If doing this, you can also modify the nav.xml file to organize each group of similar dashboards into a single menu / submenu.


If you really need to have this selectable, one possible workaround would be to use a StaticSelect and ConvertToIntention modules to do string replacement in the search string - it would look something like this:

<module name="StaticSelect" layoutPanel="splSearchControls-inline">
<param name="settingToCreate">timerange_setting</param>
<param name="staticFieldsToDisplay">
  <list>
    <param name="label">Last 60 Minutes</param>
    <param name="value">earliest=-1h</param>
  </list>
  <list>
    <param name="label">Last 24 Hours</param>
    <param name="value">earliest=-24h</param>
  </list>
  <list>
    <param name="label">Last 7 Days</param>
    <param name="value">earliest=-7d</param>
  </list>
</param>
<param name="label">Time Range:</param>
<module name="ConvertToIntention">
  <param name="settingToConvert">timerange_setting</param>
  <param name="intention">
    <param name="name">stringreplace</param>
    <param name="arg">
      <param name="timeFilter">
        <param name="value">$target$</param>
      </param>
    </param>
  </param>
  <param name="preserveParentIntentions">true</param>
  <module name="HiddenSearch" layoutPanel="panel_row1_col1" autoRun="True">
    <param name="search">$timeRange$ host=XXX termXXX</param>
    <!-- Child modules go here -->
</module>

View solution in original post

koshyk
Super Champion

Shame we can't override this in "<input type="time" " code
Alternatively, you could use "sideview Utils" which has option to provide custom time.

0 Karma

southeringtonp
Motivator

I don't believe that it possible to do this with TimeRangePicker directly. The cleanest solution is just to live with that limitation.


If you really need this functionality, you could remove the TimeRangePicker altogether, and just create multiple dashboards. This may be practical if the number is kept small. Then you can set the time range explicitly in the searches for each dashboard:

<module name="HiddenSearch">
    <param name="earliest">-24h</param>
    <param name="search">host=XXX termXXX</param>
    <!-- Child modules go here -->
</module>

If doing this, you can also modify the nav.xml file to organize each group of similar dashboards into a single menu / submenu.


If you really need to have this selectable, one possible workaround would be to use a StaticSelect and ConvertToIntention modules to do string replacement in the search string - it would look something like this:

<module name="StaticSelect" layoutPanel="splSearchControls-inline">
<param name="settingToCreate">timerange_setting</param>
<param name="staticFieldsToDisplay">
  <list>
    <param name="label">Last 60 Minutes</param>
    <param name="value">earliest=-1h</param>
  </list>
  <list>
    <param name="label">Last 24 Hours</param>
    <param name="value">earliest=-24h</param>
  </list>
  <list>
    <param name="label">Last 7 Days</param>
    <param name="value">earliest=-7d</param>
  </list>
</param>
<param name="label">Time Range:</param>
<module name="ConvertToIntention">
  <param name="settingToConvert">timerange_setting</param>
  <param name="intention">
    <param name="name">stringreplace</param>
    <param name="arg">
      <param name="timeFilter">
        <param name="value">$target$</param>
      </param>
    </param>
  </param>
  <param name="preserveParentIntentions">true</param>
  <module name="HiddenSearch" layoutPanel="panel_row1_col1" autoRun="True">
    <param name="search">$timeRange$ host=XXX termXXX</param>
    <!-- Child modules go here -->
</module>

samsplunkd
Path Finder

Any idea how this can be achieved for "Custom time..." in TimeRangePicker?

sranga
Path Finder

Thanks. Yes, this solution is what I was contemplating as well 🙂

0 Karma

adamw
Communicator

These are defined in etc/system/default/times.conf

You should probably copy this file to etc/system/local/times.conf and edit it there, so that you don't get screwed when you upgrade.

sranga
Path Finder

Thanks. Wouldn't this would affect the time-values displayed on all the dashboards/charts? The requirement is for each dashboard to display whatever time-values are appropriate for it. I've edited my post to include the per-dashboard subset of values criteria.

Get Updates on the Splunk Community!

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...

Share Your Ideas & Meet the Lantern team at .Conf! Plus All of This Month’s New ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...