How do I edit the time frame/window for a key indicator?

[llee_splunk]

How do I edit the time frame/window for a default key indicator (e.g. VULNS PER SYSTEM found in the Vulnerability Center)?

[llee_splunk · Accepted solution]

The time frame/window is embedded within the search string that populates the key indicator. (e.g. earliest=-30d@d latest=+0s).  You can edit the searches for the key indicators by going to Configure > Content Management, select Type: Key Indicator, and click on the indicator(s) that you would like to modify.

Also see: http://docs.splunk.com/Documentation/ES/latest/Admin/Createkeyindicatorsearches#Edit_a_key_indicator...

[neerajs_81]

It looks like in recent versions of ES , there is no way to edit time range for Key indicator search.  Its not even defined in the query so not sure where is ES picking the default 24 hour window. 

Below is a sample key indicator search provided by ES for Access Notables.  How can i add the time range earliest=-2d latest=now() to the below query ?

| `es_notable_events` | search security_domain=access | stats sum(count) as count by timeDiff_type | transpose | sort 1 + column | rename "row 1" as current_count,"row 2" as historical_count | `get_delta` | table current_count,historical_count,delta