Splunk ES Incident Review Dashboard Default Search Time Settings

[tezkpk]

I am a Splunk ES (enterprise security) user, looking to change the default search time setting for all users on the Incident Review dashboard. By default, it is set to search "All Time." I would like to change it to search the last 24 hours. I have tried editing the XML of the dashboard and looked into the JavaScript, which powers the dashboard, but nothing that I have tried changes the default search time for users.

It appears that the time is sent into the url as parameters (earliest=0&latest= which searches All Time). Has anyone seen the settings, whether it be through the GUI, or through the CLI, on how to change the default search time setting for the Incident Review dashboard?

[LukeMurphey · Accepted solution]

This was fixed in newer versions of ES. ES 4.5.0, 4.2.2, 4.1.3, and 4.0.5 do not default to an all-time search.