Defaulting copied times.conf to "yesterday"

[RVDowning]

When using times.conf, after having copied it to my own .../apps/appname/local directory I can't seem to set the default search time. It is being used to default values in a pie chart.

No matter what I put in the default section it seems to always default to All Time. How would I go about defaulting it to "Yesterday" for example.

[lguinn2 · Accepted solution]

For simple XML, you still don't need times.conf. Do this to set a default time on the time range picker in a dashboard:

<form>
  <label>Assortment Analytics</label>
  <description/>
  <fieldset submitbutton="false" autorun="true">
    <input type="time" searchwhenchanged="true">
      <default>
        <earliestTime>-1d@d</earliestTime>
        <latestTime>@d</latestTime>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <chart>
        <title>Datasets Created by Type</title>

[lguinn2]

No problem! Probably other folks have the same confusion, so a good question to ask!

[RVDowning]

That did it, thanks. I thought it had to be done in the times.conf file.

[lguinn2]

What version of Splunk?

Here is How to set the default search time in Splunk 6

For earlier versions (4.3 - 5.x)

How to set default search timeframes

How to set the default time for the search bar...

And you don't need a copy of times.conf to do this.

[RVDowning]

This is splunk 6.1.0

I was using simple xml as in the following:

Assortment Analytics

and just trying to modify the times.conf file appropriately. I am using it as a dropdown to populate a pie chart using the <input type = "time" shown above.

[strive]

Did you try this
order =
* The key on which all custom time ranges are sorted, ascending.
* The default time range selector in the UI will merge and sort all time
ranges according to the 'order' key, and then alphabetically.
* Optional. Default value is 0.