Dashboards & Visualizations

Splunk Ignoring </param>'s in Dashboard

pl123
Path Finder

Hi im working on developing a large advanced-xml dashboard. It appears splunk in some stanza's is ignoring some params.

For example

 ....
 ....
 <module name="HiddenSearch"> 
                  <module name="TimeRangePicker">
                    <param name="default">Last 24 hours</param>
                    <param name="searchWhenChanged">True</param>
                    <module name="HiddenSearch" autoRun="False">
                      ...
                      <module name="SubmitButton">
                        ...
                        <module name="Message" layoutPanel="graphArea">
                          ...
                          <module name="JobStatus">
                            ...
                            <module name="FlashTimeline" layoutPanel="graphArea">
                               ...
                                ...

Results in the gui time range picker still defaulting to "all time" even though it is set to 24 hours. Is there anyway to force it a particular time range, as the doc says is possible?

We are running 4.1.6, and I am editing the files from the manager. I can post the entire dash if it would help anyone (300+ lines)

Cheers

Tags (1)
0 Karma
1 Solution

sideview
SplunkTrust
SplunkTrust

This is a common point of confusion. Unfortunately the 'default' param of the TimeRangePicker has no effect once you make a different selection. Once you change it away from 'Last 24 Hours', the change is persisted in a 'viewstate', and for that Splunk user, the modified version becomes the effective default.

You can disable the stickiness of all elements in the view by placing 'isSticky="False"' into the <view> tag. This works fine if nobody has ever used the view. HOWEVER if users have already used the view, it's a different story. Unfortunately turning off the stickiness only disables subsequent changes to that stickiness - it doesnt wipe away previously 'stuck' changes. So if you put isSticky="False" into the view right now, your user account would be doomed to have 'All Time' selected by default permanently.

So, if people have already used the view, you'll also have to comb through all the viewstate stanzas in /etc/users/<username> and remove all the relevant viewstates.

Update: I just noticed that I've answered this question a couple other times too:

http://answers.splunk.com/questions/9127/timerangepicker

http://answers.splunk.com/questions/9741/timerangepicker-wont-hold-value-on-dashboard

View solution in original post

sideview
SplunkTrust
SplunkTrust

This is a common point of confusion. Unfortunately the 'default' param of the TimeRangePicker has no effect once you make a different selection. Once you change it away from 'Last 24 Hours', the change is persisted in a 'viewstate', and for that Splunk user, the modified version becomes the effective default.

You can disable the stickiness of all elements in the view by placing 'isSticky="False"' into the <view> tag. This works fine if nobody has ever used the view. HOWEVER if users have already used the view, it's a different story. Unfortunately turning off the stickiness only disables subsequent changes to that stickiness - it doesnt wipe away previously 'stuck' changes. So if you put isSticky="False" into the view right now, your user account would be doomed to have 'All Time' selected by default permanently.

So, if people have already used the view, you'll also have to comb through all the viewstate stanzas in /etc/users/<username> and remove all the relevant viewstates.

Update: I just noticed that I've answered this question a couple other times too:

http://answers.splunk.com/questions/9127/timerangepicker

http://answers.splunk.com/questions/9741/timerangepicker-wont-hold-value-on-dashboard

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...