Custom time range picker (first quater...)

[khyoung7410]

Hi

is possible first quater, second quater.. insert to into time range picker?

thank you

[lguinn2 · Accepted solution]

Yes - you can do it by editing the configuration file - times.conf. Or, you can go into Splunk Manager » User interface » Time ranges and create a new time range there. You should be careful and look at the documentation for times.conf.

Here is a link to Change the time range... in the Splunk User manual.

You could set something like this:

[ByQuarters]
label = By Quarters
order = 300
is_sub_menu = 1

[quarter_to_date]
label = Current quarter to date
header_label = from the first day of the quarter
earliest_time = @q
latest_time = now
order = 310
sub_menu = By Quarters

[LastQuarter]
label = Last Quarter
header_label = from beginning of previous quarter to the beginning of this quarter
earliest_time = -1q@q
latest_time = @q
order = 320
sub_menu = By Quarters

[q1]
label = First Quarter this Year
header_label = from January 1 through March 31
earliest_time = @y
latest_time = @y+1q
order = 330
sub_menu = By Quarters

[q2]
label = Second Quarter this Year
header_label = from April 1 through June 30
earliest_time = @y+1q
latest_time = @y+2q
order = 340
sub_menu = By Quarters

etc

[khyoung7410]

Hello lguinn
Thanks for the quick response.

[MarioM]

you can set custom configurations in times.conf, place a times.conf in $SPLUNK_HOME/etc/system/local/ or in $SPLUNK_HOME/etc/apps/<your_app>/local/