Splunk 6.0 default time in "Time Picker"

[mikelanghorst]

In previous versions the Time Picker would default to All-Time, but would remember a users last time choice. Now the behavior seems to always default back to "All Time".

What's the best place to change this, I'd rather my users not default to this.

[the_wolverine]

In ~/etc/system/local/ui-prefs.conf on your search head, set the following which will set "Last 15 minutes" as your default search time range in the picker:

[default]
dispatch.earliest_time = -15m
dispatch.latest_time = now

[jtrucks · Accepted solution]

You an change the default on the instance using the info in this post:

http://answers.splunk.com/answers/106136/how-to-set-the-default-search-time-in-splunk-6