Getting Data In

How to disable options greater than 7 days in the timepicker input on a particular dashboard

bbknowles
Explorer

Hi.

I have an interactive dashboard with a lot of data. It has multiple panels with performance data for a large number of hosts. I have been able to get it to run by a combination of things:
- the individual panels select exceptions
- the users can select Top 10, Top 20, Top 50 hosts
- they can select a range of up to 7 days

Anything more than 7 days will return truncated data errors. Is there a way to disable all other timeframe options from the timepicker selection choices?

I'd really appreciate any insights you might have.

Thanks.
Barbara

woodcock
Esteemed Legend

The easiest thing to do is to create your own very limited timepicker selector that has the few options that you allow like this:

label="Today", value="earliest=@d latest=now"
label="From yesterday", value="earliest=-1d@d latest=now"
label="From 2 days ago", value="earliest=-2d@d latest=now"
label="From 3 days ago", value="earliest=-3d@d latest=now"
label="From 4 days ago", value="earliest=-4d@d latest=now"
label="From 5 days ago", value="earliest=-5d@d latest=now"
label="From 6 days ago", value="earliest=-6d@d latest=now"
label="From 7 days ago", value="earliest=-7d@d latest=now"

Then use Your SPL here $earlylate_token$ ... as your search string

bbknowles
Explorer

So I forgot to mention that I don't have access to the config file or the file structure. Our Splunk Admin team is very strict.

And I only need to control the timeframe for this specific dashboard because there is too much data. I don't want to restrict the timeframes for all dashboards.

If I have to, I will create a custom time input, but I was hoping to simply disable the larger timeframes in the existing input.

0 Karma

DavidHourani
Super Champion

Hi @bbknowles,

Totally possible, you can do this by removing the entries you dont need from the times.conf config file, but this removes the options for all users : https://docs.splunk.com/Documentation/Splunk/7.2.6/Admin/Timesconf

If you want to apply for a fixed dashboard you can either use some JS magic as in the following link https://answers.splunk.com/answers/222650/limit-choices-in-default-timepicker.html or go for the easy way and just create your own drop down including only the time options you require (this is easier to manage and maintain).

PS: If you want to ensure that your users dont tweak the searches and get more than 7 days make sure you use their role configuration to limit the time, this can be done using the srchTimeWin = <number> setting in :
https://docs.splunk.com/Documentation/Splunk/7.2.6/Admin/authorizeconf

Cheers,
David

koshyk
Super Champion

The user can always run searches with earliest=-xx , so he/she can override if it need be if they have got a search option.

Said that,

See the solutions in below post to customize time range picker
https://answers.splunk.com/answers/222650/limit-choices-in-default-timepicker.html

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...