How to customize the Phantom dashboard time filters dropdown box (see screenshot below)?
For a Phantom instance, we have started exploring using the data retention features of Splunk Phantom keeping less than 1 year of Phantom data. It is desired to have a maximum filter equal to the current number of days for data retention. Otherwise, users are misled by time filters that are more than current number of days for data retention. A feature that might nice to have is a way to tie the Phantom dashboard time filters dropdown box to the days of data retention.
@phanTom In a large organization as you may know, the focus and expectations of users can be vary widely. It sounds like your energy may be low for a feature request to allow customization of the Phantom dashboard time filters. With one of my many roles being a Phantom admin, I do not desire to understand and maintain an additional setting that someone suggests is value added to Phantom unless several folks agree with it. What are your thoughts on a feature request for text next to the time filter dropdown that communicates the create time of the oldest container record or something similar to give the user more info about the data in the Phantom dashboard (see1st screenshot below)? Do you think that the Phantom community would be more supportive of it? As a comparison, the Splunk Enterprise search dashboard has a graph to indicate that amount of data available (see second screenshot below). Custom Splunk Enterprise dashboards much more capabilities to fulfill user requests like this one than the Phantom product. For a more direct comparison, a Splunk Enterprise user can select their own home dashboard (custom or not) in the Search app (see third screenshot below).
