Archive
Highlighted

Why is my ui-prefs.conf change to make the default search time range 15 minutes in all apps not being respected?

Builder

Goal - Change the default time of search to 15 minutes in all apps.

I created a ui-prefs.conf in the local of the search app, but this didn't work. I also tried in the local of the system and didn't work. I believe this should set my default time in search to 15 minutes, but with no luck at all.

[search]
dispatch.earliest_time = -15m@m
dispatch.latest_time = now
Tags (2)
0 Karma
Highlighted

Re: Why is my ui-prefs.conf change to make the default search time range 15 minutes in all apps not being respected?

Contributor

Have you checked to see if the user level preferences are overriding this? Every time I need to change this I have to wipe out the user/app/local/ui-prefs.conf for it to work.

0 Karma
Highlighted

Re: Why is my ui-prefs.conf change to make the default search time range 15 minutes in all apps not being respected?

Splunk Employee
Splunk Employee

There is a long discussion of a similar question already posted to Splunk Answers.

That question is about making the change persistent in the search app.

However, this specific answer to the question seems to suggest that creating dispatch.earliest and dispatch.latest settings in $SPLUNK_HOME/etc/system/local/ui-prefs.conf, using a stanza for each app, might work.

0 Karma
Highlighted

Re: Why is my ui-prefs.conf change to make the default search time range 15 minutes in all apps not being respected?

Builder

PS its better to use -15m instead of -15m@m

0 Karma