How to define fieldset time earliest/latest in one location for all dashboards in an app?

[simpkins1958]

I have 10+ dashboards in my app. Each dashboard has a fieldset time input with the defaults set for earliest/latest (see screen shot below). All 10+ dashboard need to have the same default values. I would like to set those values in one location, not in each of the XML files. I have tried doing this with macros and ui-prefs.conf with out any luck. Anyone know how I could do this? Thanks.

[somesoni2]

I think you can achieve that using Splunk's Prebuilt Panels feature. Try this

1) Create a Prebuilt panel (Settings -> User Interface -> Prebuilt Panels -> Add new) with following xml). Say you saved it with name TimeRangePickerTemplate

<panel>
  <input type="time" token="timerange">
    <label></label>
    <default>
      <earliest>-60m@m</earliest>
      <latest></latest>
    </default>
  </input>
</panel>

2) Update your dashboards to remove current time range picket that they have, add new prebuilt panel (Edit Panels -> Add Panels ->Prebuilt Panel, see this for more info http://docs.splunk.com/Documentation/Splunk/6.5.0/Viz/AddPanels). Your dashboard should look like this now

<form>
  <label>Test Prebuild Panels</label>
  <fieldset submitButton="false">
     ...other inputs if any...
  </fieldset>
<!--This is the Time range template that you're referencing-->
  <row>
    <panel app="search" ref="TimeRangeTemplate"></panel>
  </row>
...rest of the dashboard...
</form>

You would have to update your dashboard panels to use this time range picket template's token (name: timerange, see the step 1) and you're set. If you want to change the default values, just go and change in the prebuilt panel and it'll get reflected in all dashboards using it.

[simpkins1958]

Thanks. But not going to work for us. The time picker is not part of the filters that can now be hidden in 6.5.

[somesoni2]

Not sure I understood the reason why it's not going to work.