Archive

Change preset search option

Path Finder

I want to add a preset search time of 3 days. I know you can go to relative 3 days ago, but would be preferred to have it as a preset.

0 Karma
1 Solution

Yes, that's pretty simple if you're an admin on the search head. Check out this previous answer for how to do it:
https://answers.splunk.com/answers/209020/is-it-possible-to-create-a-custom-preset-for-previ.html

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

@jared_anderson, you can add Time Range in preset using Splunk UI Settings> User Interface > Time rages > Add New or directly through times.conf configuration file.

Refer to documentation: http://docs.splunk.com/Documentation/Splunk/latest/Admin/timesconf

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

Yes, that's pretty simple if you're an admin on the search head. Check out this previous answer for how to do it:
https://answers.splunk.com/answers/209020/is-it-possible-to-create-a-custom-preset-for-previ.html

View solution in original post

0 Karma