topic How to set the default search time in Splunk 6? in Dashboards & Visualizations

How to set the default search time in Splunk 6?

wpreston — Mon, 14 Oct 2013 14:08:06 GMT

How can I set the default search time in Splunk 6? I'd prefer for my users to start their searches on the last 7 days instead of all time, but I can't find where to set it at. I tried changing the value for TimeRangePicker in the flashtimeline view to "Last 7 days" then restarting Splunk, but the nothing changed in my view. Below is the change I made:

< module name="TimeRangePicker">
    < param name="selected">Last 7 days< /param>

I made this change to the following views: flashtimeline, charting, dashboard, and dashboard_live. What am I missing?

Re: How to set the default search time in Splunk 6?

cam343 — Mon, 21 Oct 2013 04:15:11 GMT

+1 this problem.

I tried: "flashtimeline" / "dashboard_live" / "charting" and manually restarted the Splunk service. Still Nothing..... Any help would be appreciated

Re: How to set the default search time in Splunk 6?

ChrisG — Wed, 23 Oct 2013 16:49:23 GMT

For a workaround, you can enable flashtimeline. You can update the <view> tag in flashtimeline.xml from

<?xml version="1.0"?>
<view onunloadCancelJobs="False" autoCancelInterval="100" isDashboard="False" type="redirect" target="search">
<!-- autoCancelInterval is set here to 100 -->
...

<?xml version="1.0"?>
<view onunloadCancelJobs="False" autoCancelInterval="100">
<!-- autoCancelInterval is set here to 100 -->
...

and then use use /app/search/flashtimeline instead of use /app/search/search

Re: How to set the default search time in Splunk 6?

wpreston — Wed, 23 Oct 2013 17:22:13 GMT

I have the work-around in place now and will be on the lookout for the future release. Thank you for the very detailed answers!!

Re: How to set the default search time in Splunk 6?

ChrisG — Thu, 24 Oct 2013 17:14:42 GMT

Further research yields this better answer:

To do this in Splunk Enterprise 6.0, use ui-prefs.conf. If you set the value in $SPLUNK_HOME/etc/system/local, all your users should see it as the default setting. For example, if your $SPLUNK_HOME/etc/system/local/ui-prefs.conf file includes:

[search]
dispatch.earliest_time = @d
dispatch.latest_time = now

The default time range that all users will see in the search app will be today.

The configuration file reference for ui-prefs.conf is here: http://docs.splunk.com/Documentation/Splunk/latest/Admin/Ui-prefsconf

We are updating the Search Manual to include this information.

I am leaving the flashtimeline workaround information here in case it's useful to people for other reasons.

Re: How to set the default search time in Splunk 6?

wpreston — Fri, 25 Oct 2013 00:56:38 GMT

Excellent, thank you ChrisG!

Re: How to set the default search time in Splunk 6?

ChrisG — Fri, 25 Oct 2013 16:22:13 GMT

Docs are updated: http://docs.splunk.com/Documentation/Splunk/6.0/Search/Selecttimerangestoapply#Change_the_default_selected_time_range

Re: How to set the default search time in Splunk 6?

ruiaires — Mon, 02 Dec 2013 14:48:48 GMT

this did not work for me... does Splunk need to be restarted ?

Re: How to set the default search time in Splunk 6?

ChrisG — Mon, 02 Dec 2013 15:51:21 GMT

Yes, this change will require a restart.

Re: How to set the default search time in Splunk 6?

sowings — Wed, 12 Feb 2014 14:19:57 GMT

@ChrisG, can you tell me how you selected the name of the stanza in your above example? The docs only mention the special [default] stanza. Is it simply the name of the view?

Re: How to set the default search time in Splunk 6?

ChrisG — Wed, 12 Feb 2014 17:43:04 GMT

What I know is in the docs (http://docs.splunk.com/Documentation/Splunk/6.0/Search/Selecttimerangestoapply#Change_the_default_selected_time_range): "the stanza name needs to match the dashboard ID for that view." If that's not working for you, let me know and I will investigate further.

Re: How to set the default search time in Splunk 6?

mthierbel — Tue, 22 Apr 2014 23:02:39 GMT

Keep in mind that the default homepage in Splunk 6.0.2 is actually the launcher app and not the search app, so configuring just the [search] stanza will not change the setting for the homepage.

I was able to get it working in both the search app and the homepage by creating a
$SPLUNK_HOME/etc/system/local/ui-prefs.conf containing these settings:

[search]
dispatch.earliest_time = -24h
dispatch.latest_time = now

[default]
dispatch.earliest_time = -24h
dispatch.latest_time = now

Re: How to set the default search time in Splunk 6?

gozulin — Tue, 06 May 2014 17:16:33 GMT

Thank you! This is a much better solution since everybody uses the launcher searchbox as you mention.

Re: How to set the default search time in Splunk 6?

dhathaway — Wed, 21 May 2014 21:48:39 GMT

Thanks, this is the info I needed to set the default for all users on both the Search and Home/Launcher pages!

Re: How to set the default search time in Splunk 6?

stefanlasiewski — Mon, 01 Dec 2014 21:25:02 GMT

For my Splunk 6.2.0 server, specifying just the [default] section is enough to specify the default search time for the Search app. I did not need two separate [search] and [default] sections. In addition, I used @d like @ChristG instead of -24h.

[default]
dispatch.earliest_time = @d
dispatch.latest_time = now

Re: How to set the default search time in Splunk 6?

stefanlasiewski — Mon, 01 Dec 2014 21:31:57 GMT

And ironically, setting the [default] section does not actually affect the default launcher app for me, but does affect certain other apps.

Re: How to set the default search time in Splunk 6?

stefanlasiewski — Mon, 01 Dec 2014 21:32:54 GMT

@ChristG -- this only works for the Search app. The vast majority of Splunk users will start off on the default homepage, not the Splunk search app. How could we specify the default search time for all apps? In addition, @mthierbel's solution doesn't work for me either.

Re: How to set the default search time in Splunk 6?

mthierbel — Mon, 01 Dec 2014 21:48:01 GMT

@stefanlasiewski -- I'm surprised applying the setting under [default] is not working for you. Which directory is your ui-prefs.conf in? Are its settings taking effect for the [search] app screen?

Re: How to set the default search time in Splunk 6?

stefanlasiewski — Tue, 02 Dec 2014 01:26:55 GMT

I added the [default] parameter to $SPLUNK_HOME/etc/system/local/ui-prefs.conf and restarted Splunk.

Re: How to set the default search time in Splunk 6?

robertlight — Wed, 01 Apr 2015 19:09:11 GMT

What I am wondering is how can I make the time-frame "sticky"? ie: if the user specifies a timeframe from midnight 12/25/2014 to midnight 12/26/2014 then at all times in the future (until I pick something else) the timeframe will be showing me info for christmas 2014.

Right now, it always switches back to the default....whereas I want it always to be what I specified previously.