Splunk Enterprise Security: How to change the default time range inside the app?

[mgrosholz]

I know how to change the default time range in the search head but it only applies to the Search & Reporting app.

Does anyone know how to change the default time within the Splunk Enterprise Security app?
I cannot find any documentation on it.

[mgrosholz · Accepted solution]

I reached out to Splunk Support and got the problem resolved. It was fairly simple. To fix via the UI follow the steps below.

1. Navigate to Settings -> Service Settings -> Search Preferences
2. Change Default search time range to "Last 4 hours" and save.
3. Navigate to ES App -> click on search -> select Search

[skalliger]

Good to know. Documented this for our future ES setup as well. Thanks!

[skalliger]

What do you mean by saying "but it only applies to the Search & Reporting app"? Did you change it in the config itself? If so, in which config did you change it?
Did you try to insert the following into $SPLUNK_HOME/etc/system/local/ui-prefs.conf? Becaue SplunkEnterpriseSecuritySuite does not contain a ui-prefs.conf I would suggest editing it in the mentioned location.

Insert a default stanza there, like this:

[default]
dispatch.earliest_time = whenever1
dispatch.latest_time = whenever2

For further information, see if this helps: https://answers.splunk.com/answers/106136/how-to-set-the-default-search-time-in-splunk-6.html

(ES SH is not running right now, otherwise I would have tested it myself.)

Skalli

[mgrosholz]

I didn't think ES had its own .conf file. I did change the default time in the location you mentioned and followed the instructions and formatting stated in the documentation.

To clarify, the search head with the ES app was changed. Within the same search head, the "Search & Reporting app does reflect the changes made. However, when you go into the ES app, and click on the "Search" tab, then the "Search" option, the setting is still set to "All Time".

[skalliger]

Ah that's unfortunate it didn't have any effect on the ES app.
I would try to create a ui-prefs.conf file in the local directory in the ES app and insert the stanza there. Maybe that helps. I would try that only on a dev/testing environment, of course. If that doesn't help either, maybe try contacting the Splunk support.