Currently we can include time range by inserting " input type="time". The default time drop down list contain about 10+ options, last 4hours, last 24 hours etc..
how do i create one custom drop down list by having only 3 options, only last 30days/1day/4hour?
In the $SPLUNKHOME/etc/system/default directory , there is a file called times "times.conf"
You could create your own customized "times.conf" file and place it in $SPLUNKHOME/etc/system/local directory , or for changes specific to a particular app the $SPLUNKHOME/etc/$APPNAME/local directory
Another thread has some good info also :