Ever since our upgrade to v6 from v5, the "Yesterday" timepicker preset is missing. I see its not a default option yet it exists in times.conf. Can someone clarify why its missing?
I see this known bug which is perhaps related:
The times.conf spec file still refers to adding submenus in order to customize time range presets; this feature does not exist in Splunk Enterprise 6.x (SPL-76798)
I've managed to replicate this - it's related to adding a larger number of custom time range presets. After adding the sixth I see
Yesterday disappear, five work fine. You've added eight, so by that logic three should be missing... and indeed, you're missing
Year to date, and
Week to date - three time ranges off the bottom of the alphabetical order are missing.
This bug is still present in 6.1.1 and not on the list of known issues so please open a support case referencing this answers page.
I dont appear to have it, and I see it present in my system/local/times.conf and system/default/times.conf. The first column of "relative" under Presets is the same as the picture in v6.0.4 documentation: http://docs.splunk.com/Documentation/Splunk/6.0.4/SearchTutorial/Aboutthetimerangepicker