Dashboards & Visualizations

changing default-search-timeframes

ajji2684
Engager

Hi

I tried to change the default search times from All time to custom timeframe by changing


All time


Last 60 minutes

It's not working .

0 Karma

sideview
SplunkTrust
SplunkTrust

The view is probably configured to be "sticky", ie up in the <view> tag there is no isSticky="False" attribute.

Which means that the view is always watching the TimeRangePicker for changes, and it always remembers the value you last set. This "sticky" value will always override the default for your user account, whereas another Splunk user who never touched the control, will see your change take effect.

One clunky thing about stickiness is that if you go now and put isSticky="false" into your view, it will indeed no longer record changes to the TimeRangePicker. Unfortunately it will continue to remember whatever the last change was before you turned stickiness off. To truly get it to ignore that value you have to go into viewstates.conf manually in etc/users/<username>/<appname>/local/viewstates.conf and delete the relevant stanza.

As a best practice I recommend setting isSticky="False" for all advanced XML views, to just avoid this issue entirely.

Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Agentic SOC Triage: Investigating Splunk ES Notables with MCP Server and a Local LLM

The Problem: Too Many Alerts, Too Little Context Security operations teams running Splunk Enterprise Security ...

All Work and No Play? Not at .conf26! Unwind at These Evening Events

Between hands-on technical sessions, keynote reveals, and diving into live architectures, .conf26 is packed ...

Join the Hackathon at .conf26 and build a No-Code AI agent

Join us for the AI Agent Buildathon, an in-person, three-hour hands-on Hackathon where you’ll use Splunk Agent ...