Splunk Search

Generic Host search only uses "all time"

MasterOogway
Communicator

When I choose a host from the Host list it automatically starts to search......but for "all time". I don't want to search for "all time". What xml file do you change to modify the initial search from "all time" to say...60 minutes or 15 minutes?

Tags (1)

briang67
Communicator

Not sure if this is the best way, but I've done this for the search app by editing $SPLUNK_HOME/etc/apps/search/default/data/ui/views/flashtimeline.xml and changed the "selected" parameter to something other than "All time".

MasterOogway
Communicator

I tried a multiple of different "time" changes:
'in the last two hours'
'two hours'
'in the last 15 minutes'

all to no avail. What timeline specifications did you use?
Thanks.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...