How to remove "All time" and "Real time" from one dashboard's timepicker

[sbattista09]

While building dashboards and having the timepicker in the dashboard, I need to find a way to remove "All time" and "Real time". Is there a way to just add a line of code in the XML?

[bmacias84]

The best way to do this is not to remove it from the UI, but to change your user permission. Thought I would probably create a custom role.

On your search heads create authorize.conf within an app or system/local directory.

[role_limited_user]
change_own_password = enabled
embed_report = enabled
get_metadata = enabled
get_typeahead = enabled
input_file = enabled
list_deployment_client = enabled
list_forwarders = enabled
list_inputs = enabled
output_file = enabled
request_remote_tok = enabled
rest_apps_view = enabled
rest_properties_get = enabled
run_debug_commands = enabled
search = enabled
schedule_search = enabled
# this settings limited there maxium search window below is two weeks in seconds
srchTimeWin = 1209600
#leave this capabilility commented out
#rtsearch = enabled

Additionally you can set the UI time picker to defaults from $SPLUNK_HOME/etc/system/local/ui-prefs.conf. Below sets the default to 15m and fast mode when the search window loads for all users.

[default]
dispatch.earliest_time = -15m
dispatch.latest_time = now
display.page.search.mode = fast

I do recommend creating a new roles.

[savithamr]

It works, but for all timepicker while logged in as role(admin)
What if i have to do for only one dashboard timepicker??

[bmacias84]

Create a custom timepicker.