- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
When using times.conf, after having copied it to my own .../apps/appname/local directory I can't seem to set the default search time. It is being used to default values in a pie chart.
No matter what I put in the default section it seems to always default to All Time. How would I go about defaulting it to "Yesterday" for example.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

For simple XML, you still don't need times.conf
. Do this to set a default time on the time range picker in a dashboard:
<form>
<label>Assortment Analytics</label>
<description/>
<fieldset submitbutton="false" autorun="true">
<input type="time" searchwhenchanged="true">
<default>
<earliestTime>-1d@d</earliestTime>
<latestTime>@d</latestTime>
</default>
</input>
</fieldset>
<row>
<panel>
<chart>
<title>Datasets Created by Type</title>
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

For simple XML, you still don't need times.conf
. Do this to set a default time on the time range picker in a dashboard:
<form>
<label>Assortment Analytics</label>
<description/>
<fieldset submitbutton="false" autorun="true">
<input type="time" searchwhenchanged="true">
<default>
<earliestTime>-1d@d</earliestTime>
<latestTime>@d</latestTime>
</default>
</input>
</fieldset>
<row>
<panel>
<chart>
<title>Datasets Created by Type</title>
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

No problem! Probably other folks have the same confusion, so a good question to ask!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
That did it, thanks. I thought it had to be done in the times.conf file.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

What version of Splunk?
Here is How to set the default search time in Splunk 6
For earlier versions (4.3 - 5.x)
How to set default search timeframes
How to set the default time for the search bar...
And you don't need a copy of times.conf
to do this.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This is splunk 6.1.0
I was using simple xml as in the following:
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Did you try this
order =
* The key on which all custom time ranges are sorted, ascending.
* The default time range selector in the UI will merge and sort all time
ranges according to the 'order' key, and then alphabetically.
* Optional. Default value is 0.
