Reporting

Change default search time for pivots from all time to 24hrs in splunk 7.2.1

srisahitya_v
Communicator

Currently when building a pivot table the default time is set to "All Time".
Is it possible to set it to some other value? I've tried overriding it by
adding the following entries to $SPLUNK_HOME/etc/system/local/ui-prefs.conf,
but they have no effect. We're running Splunk 7.2.1.

[pivot]
dispatch.earliest_time = -7d
dispatch.latest_time = now
[search]
dispatch.earliest_time = -7d
dispatch.latest_time = now
[default]
dispatch.earliest_time = -7d
dispatch.latest_time = now

Get Updates on the Splunk Community!

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...