Dashboards & Visualizations

Change metrics workspace default lookback time


Hi all,
I was wondering if anyone knew of a way to reset default search time period inside the metrics workspace.


The default seems to be an hour, which is independent of default period set in the
$SPLUNK_HOME/etc/system/local/ui-prefs.conf file which I've set to 1 day

dispatch.earliest_time = 1d@d
dispatch.latest_time = now


options that are provided in the config in

seem to provide a lookback option
earliest = -1d

but this does not affect the lookback time indicate earlier.

Also the /opt/splunk/etc/apps/splunk_metrics_workspace/README/workspace.conf.spec
option does not seems to change the default -1hour lookback

earliest = -1m
#* Sets how far back to query the metrics catalog.
#* Shortening this could speed up the catalog query.
#* Default: -2d (?default seems to be 1 hour)

Does not change the default time,  beyond the README folder documentation seems limited, any help is appreciated,

Labels (1)
0 Karma

Splunk Employee
Splunk Employee

Hi @brabagaza  thanks for flagging this bug! We're now tracking it and plan to fix it. 

0 Karma


Hi @elizabethl_splu , great to year it's being fixed, is there any place that I might be able to track the status?



0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...