Goal - Change the default time of search to 15 minutes in all apps.
I created a ui-prefs.conf in the local of the search app, but this didn't work. I also tried in the local of the system and didn't work. I believe this should set my default time in search to 15 minutes, but with no luck at all.
dispatch.earliest_time = -15m@m
dispatch.latest_time = now
This config will not take effect if there is cached user config overriding it, like @ltrand says.
Wipe out this directory for each user will work but it removes user search history etc. Also, after removing directory or config, a restart is needed. A more controlled way would be only to remove the affected stanza.
For example user Bart have used the Search app but not the MyOwnApp. Then these config changes wiil take effect for app MyOwnApp but not for the Search app. To have this change take effect for Search app as well, do this:
That question is about making the change persistent in the search app.
However, this specific answer to the question seems to suggest that creating dispatch.earliest and dispatch.latest settings in $SPLUNK_HOME/etc/system/local/ui-prefs.conf, using a stanza for each app, might work.