Dashboards & Visualizations

How do I set the default time range for the search bar of the search app's summary view?

Simeon
Splunk Employee
Splunk Employee

I want to change my default time range to search the last 15 minutes instead of all time. How could I go about doing this?

Tags (2)
1 Solution

Simeon
Splunk Employee
Splunk Employee

To change the default setting for the Search app, you must edit the TimeRangePicker module within its respective view.

http://docs.splunk.com/Documentation/Splunk/5.0/AdvancedDev/ModuleReference

To edit this, log in to Splunk and navigate to manager > views > charting. This should take you directly to a window where you can make direct xml edits. You will need to change the TimeRangePicker selected parameter to match one that is used in the times.conf file. The specific lines are:

   <module name="TimeRangePicker">
      <param name="selected">All time</param>

You may only populate the parameter with valid "label" values. Values can be found in the $SPLUNK_HOME/etc/system/default/times.conf file. So, if I wanted to use the last 15 mins as my default, I would make the following change to the selected parameter (case sensitive):

   <module name="TimeRangePicker">
      <param name="selected">Last 15 minutes</param>

Be aware that you should also change this for the charting view. So, after saving the previous change you should navigate to charting.

If you wanted to do this via CLI, you could manually recreate these files and place them in a local directory under the search app. The default files for the views are physically located here:

$SPLUNK_HOME/etc/apps/search/default/data/ui/views

The files that need to be edited are flashtimeline.xml and charting.xml.

View solution in original post

bmunson_splunk
Splunk Employee
Splunk Employee

This has changed in version 6 of splunk. You can now do this in ui-prefs.conf

http://docs.splunk.com/Documentation/Splunk/6.1.1/Search/Selecttimerangestoapply#Change_the_default_...

Simeon
Splunk Employee
Splunk Employee

To change the default setting for the Search app, you must edit the TimeRangePicker module within its respective view.

http://docs.splunk.com/Documentation/Splunk/5.0/AdvancedDev/ModuleReference

To edit this, log in to Splunk and navigate to manager > views > charting. This should take you directly to a window where you can make direct xml edits. You will need to change the TimeRangePicker selected parameter to match one that is used in the times.conf file. The specific lines are:

   <module name="TimeRangePicker">
      <param name="selected">All time</param>

You may only populate the parameter with valid "label" values. Values can be found in the $SPLUNK_HOME/etc/system/default/times.conf file. So, if I wanted to use the last 15 mins as my default, I would make the following change to the selected parameter (case sensitive):

   <module name="TimeRangePicker">
      <param name="selected">Last 15 minutes</param>

Be aware that you should also change this for the charting view. So, after saving the previous change you should navigate to charting.

If you wanted to do this via CLI, you could manually recreate these files and place them in a local directory under the search app. The default files for the views are physically located here:

$SPLUNK_HOME/etc/apps/search/default/data/ui/views

The files that need to be edited are flashtimeline.xml and charting.xml.

Get Updates on the Splunk Community!

Digital Resilience Assessment Launch | How prepared are you for disruption?

Disruption is inevitable. The question is – how prepared are you to handle it? In today’s fast-moving digital ...

Buttercup Games: Further Dashboarding Techniques (Part 2)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...

Index This | What is the next number in the series? 7,645 5,764 4,576…

February 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...