Reporting

Change default search time for pivots from all time to 24hrs in splunk 7.2.1

srisahitya_v
Communicator

Currently when building a pivot table the default time is set to "All Time".
Is it possible to set it to some other value? I've tried overriding it by
adding the following entries to $SPLUNK_HOME/etc/system/local/ui-prefs.conf,
but they have no effect. We're running Splunk 7.2.1.

[pivot]
dispatch.earliest_time = -7d
dispatch.latest_time = now
[search]
dispatch.earliest_time = -7d
dispatch.latest_time = now
[default]
dispatch.earliest_time = -7d
dispatch.latest_time = now

Get Updates on the Splunk Community!

Unlock Database Monitoring with Splunk Observability Cloud

  In today’s fast-paced digital landscape, even minor database slowdowns can disrupt user experiences and ...

Purpose in Action: How Splunk Is Helping Power an Inclusive Future for All

At Cisco, purpose isn’t a tagline—it’s a commitment. Cisco’s FY25 Purpose Report outlines how the company is ...

[Upcoming Webinar] Demo Day: Transforming IT Operations with Splunk

Join us for a live Demo Day at the Cisco Store on January 21st 10:00am - 11:00am PST In the fast-paced world ...