How do we change the default search period to one hour?

[danielbb]

We would like to change the default search period to an hour. How can we do it in 7.3?

[aaronbarry73 · Accepted solution]

Hi @danielbb, from the CLI, go to Settings > Server settings > General settings > Search preferences. There's a drop down there to change the default time range.

The documentation to do this via web, CLI or conf file is here:
https://docs.splunk.com/Documentation/Splunk/7.3.2/Admin/Changedefaultvalues#Set_the_default_time_ra...

[danielbb]

Server settings > Search preferences in 7.3

Is there a way for the users to set their own defaults?