Splunk Enterprise Security
Highlighted

Splunk Enterprise Security: How to change the default time range inside the app?

Path Finder

I know how to change the default time range in the search head but it only applies to the Search & Reporting app.

Does anyone know how to change the default time within the Splunk Enterprise Security app?
I cannot find any documentation on it.

0 Karma
Highlighted

Re: Splunk Enterprise Security: How to change the default time range inside the app?

SplunkTrust
SplunkTrust

What do you mean by saying "but it only applies to the Search & Reporting app"? Did you change it in the config itself? If so, in which config did you change it?
Did you try to insert the following into $SPLUNK_HOME/etc/system/local/ui-prefs.conf? Becaue SplunkEnterpriseSecuritySuite does not contain a ui-prefs.conf I would suggest editing it in the mentioned location.

Insert a default stanza there, like this:

[default]
dispatch.earliest_time = whenever1
dispatch.latest_time = whenever2

For further information, see if this helps: https://answers.splunk.com/answers/106136/how-to-set-the-default-search-time-in-splunk-6.html

(ES SH is not running right now, otherwise I would have tested it myself.)

Skalli

0 Karma
Highlighted

Re: Splunk Enterprise Security: How to change the default time range inside the app?

Path Finder

I didn't think ES had its own .conf file. I did change the default time in the location you mentioned and followed the instructions and formatting stated in the documentation.

To clarify, the search head with the ES app was changed. Within the same search head, the "Search & Reporting app does reflect the changes made. However, when you go into the ES app, and click on the "Search" tab, then the "Search" option, the setting is still set to "All Time".

0 Karma
Highlighted

Re: Splunk Enterprise Security: How to change the default time range inside the app?

SplunkTrust
SplunkTrust

Ah that's unfortunate it didn't have any effect on the ES app.
I would try to create a ui-prefs.conf file in the local directory in the ES app and insert the stanza there. Maybe that helps. I would try that only on a dev/testing environment, of course. If that doesn't help either, maybe try contacting the Splunk support.

0 Karma
Highlighted

Re: Splunk Enterprise Security: How to change the default time range inside the app?

Path Finder

I reached out to Splunk Support and got the problem resolved. It was fairly simple. To fix via the UI follow the steps below.

  1. Navigate to Settings -> Service Settings -> Search Preferences
  2. Change Default search time range to "Last 4 hours" and save.
  3. Navigate to ES App -> click on search -> select Search

View solution in original post

Highlighted

Re: Splunk Enterprise Security: How to change the default time range inside the app?

SplunkTrust
SplunkTrust

Good to know. Documented this for our future ES setup as well. Thanks!

0 Karma