Splunk Search

How to set Default Time Range for View in viewstates.conf

tkadale
Path Finder

I have Screen 1 for which I have set default time range in viewstates.conf for a user as follows:

[Screen_1:_current]

TimeRangePicker_0_0_0.default = Last 7 days

When Screen Loads for first time, it shows default time range as Last 7 Days.

then I change the time range to "All Time" and see the graphs.

After this I refresh the application. When I again select this Screen, default is shown "All Time".

I have used isSticky=false in the XML of the Screen.

When I checked viewstates.conf the default automatically changes to "All Time" from "Last 7 Days".

Can anybody help.

Thanks in advance!

Tags (1)
0 Karma

hazekamp
Builder

tkadale,

Have you tried '_current' in viewstates.conf?

## viewstates.conf
<viewstate_id> = '_current' is a reserved name for normal view 'sticky state'
0 Karma

tkadale
Path Finder

Thanks for the reply!

Sorry I didnt get what you want to say.I have configured in viewstates.conf as mentioned above.

Please provide more details if possible

0 Karma
Get Updates on the Splunk Community!

Infographic provides the TL;DR for the 2024 Splunk Career Impact Report

We’ve been buzzing with excitement about the recent validation of Splunk Education! The 2024 Splunk Career ...

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...