How to save custom time range for user interface to be used in reports?

[HeinzWaescher]

Hi,

I would like to save a custom time range, that can be used in reports.

settings -> user interface -> time ranges:

Name: Test
Label Test

Earliest time: 1406851200
Latest time: @d

Submenu: Other

Spunk complains about the "invalid time: 1406851200". How can I set the earliest time to a specific date? I've already done something like this, but I can't remember how to avoid this error...

BR

Heinz

[martin_mueller · Accepted solution]

times.conf specifically allows epoch times, so you might just need to edit it there: http://docs.splunk.com/Documentation/Splunk/6.1.3/Admin/timesconf

Alternatively, assuming you only need that custom time range for a limited amount of time, you could write a relative time expression that does the same thing for long enough - in your case you might be looking for @y+7mon to mean "the start of August this year", good until December 31st.

[HeinzWaescher]

Editing the times.conf worked fine. But I'm still wondering, how I was able to use a timestamp in the UI some months ago 😉

Thanks!