topic Re: default search timeframes in Splunk Search

default search timeframes

a212830 — Wed, 25 Apr 2012 18:46:40 GMT

I tried doing this, and it worked for the Summary view, but once I picked on a specific source or sourcetype, it went back to "All Time". Is there a way to change the default so that when I go from Summary to an individual source/sourctype, it won't be "All Time"?

Re: default search timeframes

lguinn2 — Mon, 28 Sep 2020 11:44:01 GMT

You need to change this in all of the search views. For Splunk 4.3, there are two default search views in the Search app.

Look under Manager » User interface » Views and choose the App Context "search".
You should see a view named "flashtimeline" and a view named "dashboard_live". (BTW, dashboard_live is the name of the Summary view.)

Edit each view by clicking on its name. Look for the two lines

<module name="TimeRangePicker"> <param name="selected">All time</param>

Change All time to the default time range of your choice. Spell it exactly as it appears in the time range picker drop-down. For example

<module name="TimeRangePicker"> <param name="selected">Last 60 minutes</param>

Save your edits.

When you have done this for both views, you will have altered the defaults. If you have other, custom search views, you may need to edit them as well. And you may need to repeat this when you install updates to Splunk. Fortunately, it is easy to do.

Re: default search timeframes

baconm — Mon, 28 Sep 2020 14:51:30 GMT

This can also be set on a per-user basis in the etc/users//search/local/viewstates.conf file:

[flashtimeline:_current]
TimeRangePicker_0_1_0.default = Last 15 minutes

[dashboard_live:_current]
TimeRangePicker_0_1_0.default = Last 4 hours

Re: default search timeframes

JimDeich — Mon, 02 Dec 2013 21:31:41 GMT

For version 6.0 I put in the changes in Manager » User interface » Views

on but the default still shows as "All time"
Are there other views to be added for Splunk 6 ?

Re: default search timeframes

ChrisG — Fri, 03 Jan 2014 22:41:21 GMT

In 6.0, use the ui-prefs.conf file. See http://docs.splunk.com/Documentation/Splunk/6.0.1/Search/Selecttimerangestoapply#Change_the_default_selected_time_range.