I know how to change the default time range in the search head but it only applies to the Search & Reporting app.
Does anyone know how to change the default time within the Splunk Enterprise Security app?
I cannot find any documentation on it.
What do you mean by saying "but it only applies to the Search & Reporting app"? Did you change it in the config itself? If so, in which config did you change it?
Did you try to insert the following into $SPLUNK_HOME/etc/system/local/ui-prefs.conf? Becaue SplunkEnterpriseSecuritySuite does not contain a ui-prefs.conf I would suggest editing it in the mentioned location.
Insert a default stanza there, like this:
[default] dispatch.earliest_time = whenever1 dispatch.latest_time = whenever2
For further information, see if this helps: https://answers.splunk.com/answers/106136/how-to-set-the-default-search-time-in-splunk-6.html
(ES SH is not running right now, otherwise I would have tested it myself.)
I didn't think ES had its own .conf file. I did change the default time in the location you mentioned and followed the instructions and formatting stated in the documentation.
To clarify, the search head with the ES app was changed. Within the same search head, the "Search & Reporting app does reflect the changes made. However, when you go into the ES app, and click on the "Search" tab, then the "Search" option, the setting is still set to "All Time".
Ah that's unfortunate it didn't have any effect on the ES app.
I would try to create a ui-prefs.conf file in the local directory in the ES app and insert the stanza there. Maybe that helps. I would try that only on a dev/testing environment, of course. If that doesn't help either, maybe try contacting the Splunk support.
I reached out to Splunk Support and got the problem resolved. It was fairly simple. To fix via the UI follow the steps below.