Dashboards & Visualizations

Custom times.conf

Brian_Osburn
Builder

In this app I'm working on, I would like to restrict what the users can select from the time range picker.

Specifically, I'm looking to remove the real time and all time options. In addition, I am re-ordering some of the items.

I copied $SPLUNK_HOME/etc/system/default/times.conf to $SPLUNK_HOME/etc/apps/$app_name/system/default and modified it.

Running ./splunk cmd btool times list --debug shows it picking up the configuration from the app specific times.conf. Unfortunately, in the advanced xml dashboard I'm working on that has the TimeRangePicker but still shows the standard time dropdowns.

Any ideas?

Tags (2)
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

Update: According to another answer by caphrim007 that there is a disabled = true option that is not documented (as of 4.1.5), but available in 4.1.x and up, so the below comments about sub_menu are only relevant for use on 4.0.x.


With all config files, the stanzas in scope are merged by stanza to generate the configuration that is relevant. In the case of times.conf, each time range is a separate stanza, so unless you disable on that is inherited from the system, it will remain.

There is no explicit "disable" option that you can provide in your app to override/disable the inherited. However, an embarrassing workaround is to set:

sub_menu = _non_existent_sub_menu

for each stanza/range that you want removed from your app in your app's times.conf. This will suppress the respective stanza/range as long as there is no sub-menu by that name.


Regarding btool, you should use the --app=myapp option to see the effective configuration file for your app.

View solution in original post

caphrim007
Path Finder

I can verify what gkanapathy said about "disabled = true"


[real_time_menu]
disabled = true

[other]
disabled = true

works to remove the "Other" and "Real-time" menus from the TimeRangePicker if you add them to a times.conf in your app's default or local directory. Using splunk 4.1.4

srinathd
Contributor

[real_time_menu]
disabled=true

is not working. still it is showing the real time menu in time range picker

0 Karma

mcronkrite
Splunk Employee
Splunk Employee

Yes this is still available in 6.0 just confirmed. You may want to checkout btool results, and also verify that you've restarted, and make sure nothing in local of your app is overriding you default.

0 Karma

jpenetra
Explorer

Is this still available on splunk 6.0? I've created the times.conf file on the default folder of my app and the real_time_menu and the other menu still appear.

0 Karma

helge
Builder

In 5.0.1 "disabled=true" is still not documented, but it works for all stanzas.

gkanapathy
Splunk Employee
Splunk Employee

Update: According to another answer by caphrim007 that there is a disabled = true option that is not documented (as of 4.1.5), but available in 4.1.x and up, so the below comments about sub_menu are only relevant for use on 4.0.x.


With all config files, the stanzas in scope are merged by stanza to generate the configuration that is relevant. In the case of times.conf, each time range is a separate stanza, so unless you disable on that is inherited from the system, it will remain.

There is no explicit "disable" option that you can provide in your app to override/disable the inherited. However, an embarrassing workaround is to set:

sub_menu = _non_existent_sub_menu

for each stanza/range that you want removed from your app in your app's times.conf. This will suppress the respective stanza/range as long as there is no sub-menu by that name.


Regarding btool, you should use the --app=myapp option to see the effective configuration file for your app.

gkanapathy
Splunk Employee
Splunk Employee

I think you can get rid of a sub menu by setting it's sub menu property to a non existent sub menu as well, but I don't know if there's a way to turn off the "custom time" option. I had a bug filed on this and it is marked "fixed", so perhaps you can use "disabled = true" or "enabled = false" and it's just not documented.

0 Karma

Brian_Osburn
Builder

I like that - "embarrassing work around".

I recopied the times.conf over, modified it so that the pre-set time ranges were set to a non existant sub menu.

Unfortunately the "Custom Time" range is still available, and sub-menu's are still visible even if they don't have any time ranges under them.

I'm thinking this may have to be changed into an enhancement request - seems like we need to have more control over the "TimeRangePicker" module.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...