Archive

Modify Splunk 6 Default Search Page to Modify Default Search Range and Disable Real-Time Search

Communicator

The default Splunk 6 search page defaults the time range to "all time" and kicks off a real-time search. To save system resources and minimize users kicking off "all time" searches I would like to know how to modify this dashboard. If you look at the code for the "search" page it refers to "app.html" which refers to "base.html" and I don't see anything in the code on these pages that relate to modules on the default search page. Any pointers would be appreciated.

Default Page - https://SPLUNKSERVER/en-US/app/search/search

Tags (2)

Communicator

Nope. In a future release this will be disabled I have heard.

0 Karma

Motivator

Did you find out how to customize the search.xml?

0 Karma

Path Finder
0 Karma