Dashboards & Visualizations

changing default-search-timeframes



I tried to change the default search times from All time to custom timeframe by changing

All time

Last 60 minutes

It's not working .

0 Karma


The view is probably configured to be "sticky", ie up in the <view> tag there is no isSticky="False" attribute.

Which means that the view is always watching the TimeRangePicker for changes, and it always remembers the value you last set. This "sticky" value will always override the default for your user account, whereas another Splunk user who never touched the control, will see your change take effect.

One clunky thing about stickiness is that if you go now and put isSticky="false" into your view, it will indeed no longer record changes to the TimeRangePicker. Unfortunately it will continue to remember whatever the last change was before you turned stickiness off. To truly get it to ignore that value you have to go into viewstates.conf manually in etc/users/<username>/<appname>/local/viewstates.conf and delete the relevant stanza.

As a best practice I recommend setting isSticky="False" for all advanced XML views, to just avoid this issue entirely.

Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...