Dashboards & Visualizations

TimeRangePicker

bsteelz93
Path Finder

How do you set a default time range for an app? I set it in the TimeRangePicker module:

Last 15 minutes True

This makes the default to 15 minutes but if the user changes it the next time they log on its not at the default of 15 minutes. It goes to whatever they were searching for the last time.

I have read the module instructions and it seems the selected feature is deprecated. They want you to use default. I set the default time range of 15 minutes in times.conf but that did not take either. Which is the proper way to do it and how do I make it persist?

Tags (2)
1 Solution

sideview
SplunkTrust
SplunkTrust

If you put isSticky="False" into the <view> tag at the top of the view, that will disable all of the 'sticky' stuff. The downside here is that the other stuff that you probably do want persisted will now not be persisted - ie the FieldPicker's field list, the number of events per page, the lines per event, etc...

The other thing that gets people all the time, is that when you click on one of the blue links on the summary dashboard, it goes to the search view and it always searches over all time. This is actually because

a) it's the view where you click that specifies the timerange, not the target view.

b) even when the timerange appears to be unspecified (as in the summary dashboard), there's always an implicit timerange of 'all time'.

However you can sneak in a

<module name="HiddenSearch">
  <param name="earliest">-15m@m</param>
  <param name="latest">+1m@m</param>
  [[ other modules ]]]
</module>

into the dashboard config where needed and it'll make the blue link clicks search over the given timerange instead.

View solution in original post

sideview
SplunkTrust
SplunkTrust

If you put isSticky="False" into the <view> tag at the top of the view, that will disable all of the 'sticky' stuff. The downside here is that the other stuff that you probably do want persisted will now not be persisted - ie the FieldPicker's field list, the number of events per page, the lines per event, etc...

The other thing that gets people all the time, is that when you click on one of the blue links on the summary dashboard, it goes to the search view and it always searches over all time. This is actually because

a) it's the view where you click that specifies the timerange, not the target view.

b) even when the timerange appears to be unspecified (as in the summary dashboard), there's always an implicit timerange of 'all time'.

However you can sneak in a

<module name="HiddenSearch">
  <param name="earliest">-15m@m</param>
  <param name="latest">+1m@m</param>
  [[ other modules ]]]
</module>

into the dashboard config where needed and it'll make the blue link clicks search over the given timerange instead.

I-Man
Communicator

So.....isSticky="False" did work after a few trial and errors.

We set the values on the dashboard to what we wanted while "isSticky="False"" was not included in the xml. Once the values were set on the dashboard, we opened another tab with the XML, added isSticky="False", and saved. Once we refreshed the dashboard, the time range values are now stuck until changed.

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...