How do I set the default time range for the search bar of the search app's summary view?

[Simeon]

I want to change my default time range to search the last 15 minutes instead of all time. How could I go about doing this?

[bmunson_splunk]

This has changed in version 6 of splunk. You can now do this in ui-prefs.conf

http://docs.splunk.com/Documentation/Splunk/6.1.1/Search/Selecttimerangestoapply#Change_the_default_...

[Simeon · Accepted solution]

To change the default setting for the Search app, you must edit the TimeRangePicker module within its respective view.

http://docs.splunk.com/Documentation/Splunk/5.0/AdvancedDev/ModuleReference

To edit this, log in to Splunk and navigate to manager > views > charting. This should take you directly to a window where you can make direct xml edits. You will need to change the TimeRangePicker selected parameter to match one that is used in the times.conf file. The specific lines are:

   <module name="TimeRangePicker">
      <param name="selected">All time</param>

You may only populate the parameter with valid "label" values. Values can be found in the $SPLUNK_HOME/etc/system/default/times.conf file. So, if I wanted to use the last 15 mins as my default, I would make the following change to the selected parameter (case sensitive):

   <module name="TimeRangePicker">
      <param name="selected">Last 15 minutes</param>

Be aware that you should also change this for the charting view. So, after saving the previous change you should navigate to charting.

If you wanted to do this via CLI, you could manually recreate these files and place them in a local directory under the search app. The default files for the views are physically located here:

$SPLUNK_HOME/etc/apps/search/default/data/ui/views

The files that need to be edited are flashtimeline.xml and charting.xml.