Custom times.conf

Question

In this app I'm working on, I would like to restrict what the users can select from the time range picker.

Specifically, I'm looking to remove the real time and all time options. In addition, I am re-ordering some of the items.

I copied $SPLUNK_HOME/etc/system/default/times.conf to $SPLUNK_HOME/etc/apps/$app_name/system/default and modified it.

Running ./splunk cmd btool times list --debug shows it picking up the configuration from the app specific times.conf. Unfortunately, in the advanced xml dashboard I'm working on that has the TimeRangePicker but still shows the standard time dropdowns.

Any ideas?

Accepted Answer

3

Update: According to another answer by caphrim007 that there is a disabled = true option that is not documented (as of 4.1.5), but available in 4.1.x and up, so the below comments about sub_menu are only relevant for use on 4.0.x.

With all config files, the stanzas in scope are merged by stanza to generate the configuration that is relevant. In the case of times.conf, each time range is a separate stanza, so unless you disable on that is inherited from the system, it will remain.

There is no explicit "disable" option that you can provide in your app to override/disable the inherited. However, an embarrassing workaround is to set:

sub_menu = _non_existent_sub_menu

for each stanza/range that you want removed from your app in your app's times.conf. This will suppress the respective stanza/range as long as there is no sub-menu by that name.

Regarding btool, you should use the --app=myapp option to see the effective configuration file for your app.

link

answered 03 Sep '10, 00:16

gkanapathy ♦
26.5k●1●6●22
accept rate: 42%

edited 13 Sep '10, 18:23

I like that - "embarrassing work around".

I recopied the times.conf over, modified it so that the pre-set time ranges were set to a non existant sub menu.

Unfortunately the "Custom Time" range is still available, and sub-menu's are still visible even if they don't have any time ranges under them.

I'm thinking this may have to be changed into an enhancement request - seems like we need to have more control over the "TimeRangePicker" module.

(03 Sep '10, 12:10) Brian Osburn

I think you can get rid of a sub menu by setting it's sub menu property to a non existent sub menu as well, but I don't know if there's a way to turn off the "custom time" option. I had a bug filed on this and it is marked "fixed", so perhaps you can use "disabled = true" or "enabled = false" and it's just not documented.

(03 Sep '10, 14:07) gkanapathy ♦

Answer 2

2

I can verify what gkanapathy said about "disabled = true"


[real_time_menu]
disabled = true

[other]
disabled = true

works to remove the "Other" and "Real-time" menus from the TimeRangePicker if you add them to a times.conf in your app's default or local directory. Using splunk 4.1.4

link

answered 13 Sep '10, 14:48

caphrim007
195●10
accept rate: 50%

Custom times.conf

Follow this question

Splunk Resources

Related questions