Dashboards & Visualizations

Defaulting copied times.conf to "yesterday"

RVDowning
Contributor

When using times.conf, after having copied it to my own .../apps/appname/local directory I can't seem to set the default search time. It is being used to default values in a pie chart.

No matter what I put in the default section it seems to always default to All Time. How would I go about defaulting it to "Yesterday" for example.

Tags (1)
0 Karma
1 Solution

lguinn2
Legend

For simple XML, you still don't need times.conf. Do this to set a default time on the time range picker in a dashboard:

<form>
  <label>Assortment Analytics</label>
  <description/>
  <fieldset submitbutton="false" autorun="true">
    <input type="time" searchwhenchanged="true">
      <default>
        <earliestTime>-1d@d</earliestTime>
        <latestTime>@d</latestTime>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <chart>
        <title>Datasets Created by Type</title>

View solution in original post

0 Karma

lguinn2
Legend

For simple XML, you still don't need times.conf. Do this to set a default time on the time range picker in a dashboard:

<form>
  <label>Assortment Analytics</label>
  <description/>
  <fieldset submitbutton="false" autorun="true">
    <input type="time" searchwhenchanged="true">
      <default>
        <earliestTime>-1d@d</earliestTime>
        <latestTime>@d</latestTime>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <chart>
        <title>Datasets Created by Type</title>
0 Karma

lguinn2
Legend

No problem! Probably other folks have the same confusion, so a good question to ask!

0 Karma

RVDowning
Contributor

That did it, thanks. I thought it had to be done in the times.conf file.

0 Karma

lguinn2
Legend

What version of Splunk?

Here is How to set the default search time in Splunk 6

For earlier versions (4.3 - 5.x)

How to set default search timeframes

How to set the default time for the search bar...

And you don't need a copy of times.conf to do this.

RVDowning
Contributor

This is splunk 6.1.0

I was using simple xml as in the following:










Datasets Created by Type

and just trying to modify the times.conf file appropriately. I am using it as a dropdown to populate a pie chart using the <input type = "time" shown above.

0 Karma

strive
Influencer

Did you try this
order =
* The key on which all custom time ranges are sorted, ascending.
* The default time range selector in the UI will merge and sort all time
ranges according to the 'order' key, and then alphabetically.
* Optional. Default value is 0.

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...