Dashboards & Visualizations

TimeRangePicker - Custom values

sranga
Path Finder

Hi

I was wondering if its possible to only display a subset of the values provided by the TimeRangePicker. Each dashboard could display its own subset of values.

For instance, I want to display just the "Last 60 minutes", "Last 24 hours" and "Last 7 days" on one dashboard and "Month to date" and "Year to date" on a different dashboard.

Thanks.

Ranga

1 Solution

southeringtonp
Motivator

I don't believe that it possible to do this with TimeRangePicker directly. The cleanest solution is just to live with that limitation.


If you really need this functionality, you could remove the TimeRangePicker altogether, and just create multiple dashboards. This may be practical if the number is kept small. Then you can set the time range explicitly in the searches for each dashboard:

<module name="HiddenSearch">
    <param name="earliest">-24h</param>
    <param name="search">host=XXX termXXX</param>
    <!-- Child modules go here -->
</module>

If doing this, you can also modify the nav.xml file to organize each group of similar dashboards into a single menu / submenu.


If you really need to have this selectable, one possible workaround would be to use a StaticSelect and ConvertToIntention modules to do string replacement in the search string - it would look something like this:

<module name="StaticSelect" layoutPanel="splSearchControls-inline">
<param name="settingToCreate">timerange_setting</param>
<param name="staticFieldsToDisplay">
  <list>
    <param name="label">Last 60 Minutes</param>
    <param name="value">earliest=-1h</param>
  </list>
  <list>
    <param name="label">Last 24 Hours</param>
    <param name="value">earliest=-24h</param>
  </list>
  <list>
    <param name="label">Last 7 Days</param>
    <param name="value">earliest=-7d</param>
  </list>
</param>
<param name="label">Time Range:</param>
<module name="ConvertToIntention">
  <param name="settingToConvert">timerange_setting</param>
  <param name="intention">
    <param name="name">stringreplace</param>
    <param name="arg">
      <param name="timeFilter">
        <param name="value">$target$</param>
      </param>
    </param>
  </param>
  <param name="preserveParentIntentions">true</param>
  <module name="HiddenSearch" layoutPanel="panel_row1_col1" autoRun="True">
    <param name="search">$timeRange$ host=XXX termXXX</param>
    <!-- Child modules go here -->
</module>

View solution in original post

koshyk
Super Champion

Shame we can't override this in "<input type="time" " code
Alternatively, you could use "sideview Utils" which has option to provide custom time.

0 Karma

southeringtonp
Motivator

I don't believe that it possible to do this with TimeRangePicker directly. The cleanest solution is just to live with that limitation.


If you really need this functionality, you could remove the TimeRangePicker altogether, and just create multiple dashboards. This may be practical if the number is kept small. Then you can set the time range explicitly in the searches for each dashboard:

<module name="HiddenSearch">
    <param name="earliest">-24h</param>
    <param name="search">host=XXX termXXX</param>
    <!-- Child modules go here -->
</module>

If doing this, you can also modify the nav.xml file to organize each group of similar dashboards into a single menu / submenu.


If you really need to have this selectable, one possible workaround would be to use a StaticSelect and ConvertToIntention modules to do string replacement in the search string - it would look something like this:

<module name="StaticSelect" layoutPanel="splSearchControls-inline">
<param name="settingToCreate">timerange_setting</param>
<param name="staticFieldsToDisplay">
  <list>
    <param name="label">Last 60 Minutes</param>
    <param name="value">earliest=-1h</param>
  </list>
  <list>
    <param name="label">Last 24 Hours</param>
    <param name="value">earliest=-24h</param>
  </list>
  <list>
    <param name="label">Last 7 Days</param>
    <param name="value">earliest=-7d</param>
  </list>
</param>
<param name="label">Time Range:</param>
<module name="ConvertToIntention">
  <param name="settingToConvert">timerange_setting</param>
  <param name="intention">
    <param name="name">stringreplace</param>
    <param name="arg">
      <param name="timeFilter">
        <param name="value">$target$</param>
      </param>
    </param>
  </param>
  <param name="preserveParentIntentions">true</param>
  <module name="HiddenSearch" layoutPanel="panel_row1_col1" autoRun="True">
    <param name="search">$timeRange$ host=XXX termXXX</param>
    <!-- Child modules go here -->
</module>

samsplunkd
Path Finder

Any idea how this can be achieved for "Custom time..." in TimeRangePicker?

sranga
Path Finder

Thanks. Yes, this solution is what I was contemplating as well 🙂

0 Karma

adamw
Communicator

These are defined in etc/system/default/times.conf

You should probably copy this file to etc/system/local/times.conf and edit it there, so that you don't get screwed when you upgrade.

sranga
Path Finder

Thanks. Wouldn't this would affect the time-values displayed on all the dashboards/charts? The requirement is for each dashboard to display whatever time-values are appropriate for it. I've edited my post to include the per-dashboard subset of values criteria.

Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...