How to set a default time in the time picklist of 01/29/2010 04:30:000

[jkucera]

I have a dashboard with a time input that drives all of the reports. However, I can't figure out how to default this to a non-standard time that is a specific date and time.

Any tips?

<form>
  <fieldset>    
     <input type="time">
          <label>Select the time range for the report</label>
          <default>Last 30 days </default>
     </input>

  </fieldset>
  <row>
    <single>
      <searchString>index="webdev" source="*chatter*" sourcetype="wdout" "TRACKER_RESULT={SUCCESS}}" |stats count</searchString>
      <title>Signups from www.chatter.com</title>;
    </single>
  </row>
</form>

[sideview · Accepted solution]

Well your options with the default stuff are a bit limited.

The only way I can think of to do this is to literally add a whole extra entry to the TimeRangePicker across all views. To do that, you add a stanza to times.conf, either from your app in etc/apps/<appname>/default/times.conf or for all apps in etc/system/local/times.conf.

Putting it just in the app will add that timerange to all TimeRangePicker modules in that app. Putting it in system on the other hand will do the same but for all apps.

And then in a particular view you set that as the default by setting the <default> to whatever the label of your custom times.conf stanza is.

So, for instance:

[my_custom_time_stanza]
label = Since 1/29/2010 04:30AM
header_label = since Jan 29 2010 04:30AM
earliest_time = 1296304200
latest_time = now
order = 35

and then in the XML:

<default>Since 1/29/2010 04:30AM</default>

It should work. Note that you probably want to turn isSticky to 'false', otherwise as soon as a given user changes the TimeRange, your default will no longer apply. (see related question @ http://answers.splunk.com/questions/9741/timerangepicker-wont-hold-value-on-dashboard )

Well, technically there is another way with the core UI -- you could have a dropdown element called 'earliest' and then have it turn into earliest=$earliest$ in your search. But the UI will nag you with these blue warnings and it's kind of an ugly approach for a couple reasons.