Dashboards & Visualizations

Defaulting copied times.conf to "yesterday"

RVDowning
Contributor

When using times.conf, after having copied it to my own .../apps/appname/local directory I can't seem to set the default search time. It is being used to default values in a pie chart.

No matter what I put in the default section it seems to always default to All Time. How would I go about defaulting it to "Yesterday" for example.

Tags (1)
0 Karma
1 Solution

lguinn2
Legend

For simple XML, you still don't need times.conf. Do this to set a default time on the time range picker in a dashboard:

<form>
  <label>Assortment Analytics</label>
  <description/>
  <fieldset submitbutton="false" autorun="true">
    <input type="time" searchwhenchanged="true">
      <default>
        <earliestTime>-1d@d</earliestTime>
        <latestTime>@d</latestTime>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <chart>
        <title>Datasets Created by Type</title>

View solution in original post

0 Karma

lguinn2
Legend

For simple XML, you still don't need times.conf. Do this to set a default time on the time range picker in a dashboard:

<form>
  <label>Assortment Analytics</label>
  <description/>
  <fieldset submitbutton="false" autorun="true">
    <input type="time" searchwhenchanged="true">
      <default>
        <earliestTime>-1d@d</earliestTime>
        <latestTime>@d</latestTime>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <chart>
        <title>Datasets Created by Type</title>
0 Karma

lguinn2
Legend

No problem! Probably other folks have the same confusion, so a good question to ask!

0 Karma

RVDowning
Contributor

That did it, thanks. I thought it had to be done in the times.conf file.

0 Karma

lguinn2
Legend

What version of Splunk?

Here is How to set the default search time in Splunk 6

For earlier versions (4.3 - 5.x)

How to set default search timeframes

How to set the default time for the search bar...

And you don't need a copy of times.conf to do this.

RVDowning
Contributor

This is splunk 6.1.0

I was using simple xml as in the following:










Datasets Created by Type

and just trying to modify the times.conf file appropriately. I am using it as a dropdown to populate a pie chart using the <input type = "time" shown above.

0 Karma

strive
Influencer

Did you try this
order =
* The key on which all custom time ranges are sorted, ascending.
* The default time range selector in the UI will merge and sort all time
ranges according to the 'order' key, and then alphabetically.
* Optional. Default value is 0.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...