Dashboards & Visualizations

Defaulting copied times.conf to "yesterday"

RVDowning
Contributor

When using times.conf, after having copied it to my own .../apps/appname/local directory I can't seem to set the default search time. It is being used to default values in a pie chart.

No matter what I put in the default section it seems to always default to All Time. How would I go about defaulting it to "Yesterday" for example.

Tags (1)
0 Karma
1 Solution

lguinn2
Legend

For simple XML, you still don't need times.conf. Do this to set a default time on the time range picker in a dashboard:

<form>
  <label>Assortment Analytics</label>
  <description/>
  <fieldset submitbutton="false" autorun="true">
    <input type="time" searchwhenchanged="true">
      <default>
        <earliestTime>-1d@d</earliestTime>
        <latestTime>@d</latestTime>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <chart>
        <title>Datasets Created by Type</title>

View solution in original post

0 Karma

lguinn2
Legend

For simple XML, you still don't need times.conf. Do this to set a default time on the time range picker in a dashboard:

<form>
  <label>Assortment Analytics</label>
  <description/>
  <fieldset submitbutton="false" autorun="true">
    <input type="time" searchwhenchanged="true">
      <default>
        <earliestTime>-1d@d</earliestTime>
        <latestTime>@d</latestTime>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <chart>
        <title>Datasets Created by Type</title>
0 Karma

lguinn2
Legend

No problem! Probably other folks have the same confusion, so a good question to ask!

0 Karma

RVDowning
Contributor

That did it, thanks. I thought it had to be done in the times.conf file.

0 Karma

lguinn2
Legend

What version of Splunk?

Here is How to set the default search time in Splunk 6

For earlier versions (4.3 - 5.x)

How to set default search timeframes

How to set the default time for the search bar...

And you don't need a copy of times.conf to do this.

RVDowning
Contributor

This is splunk 6.1.0

I was using simple xml as in the following:










Datasets Created by Type

and just trying to modify the times.conf file appropriately. I am using it as a dropdown to populate a pie chart using the <input type = "time" shown above.

0 Karma

strive
Influencer

Did you try this
order =
* The key on which all custom time ranges are sorted, ascending.
* The default time range selector in the UI will merge and sort all time
ranges according to the 'order' key, and then alphabetically.
* Optional. Default value is 0.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...