default search timeframes

[a212830]

I tried doing this, and it worked for the Summary view, but once I picked on a specific source or sourcetype, it went back to "All Time". Is there a way to change the default so that when I go from Summary to an individual source/sourctype, it won't be "All Time"?

[baconm]

This can also be set on a per-user basis in the etc/users//search/local/viewstates.conf file:

[flashtimeline:_current]
TimeRangePicker_0_1_0.default = Last 15 minutes

[dashboard_live:_current]
TimeRangePicker_0_1_0.default = Last 4 hours

[lguinn2]

You need to change this in all of the search views. For Splunk 4.3, there are two default search views in the Search app.

Look under Manager » User interface » Views and choose the App Context "search".
You should see a view named "flashtimeline" and a view named "dashboard_live". (BTW, dashboard_live is the name of the Summary view.)

Edit each view by clicking on its name. Look for the two lines

<module name="TimeRangePicker">
    <param name="selected">All time</param>


Change All time to the default time range of your choice. Spell it exactly as it appears in the time range picker drop-down. For example

<module name="TimeRangePicker">
    <param name="selected">Last 60 minutes</param>


Save your edits.

When you have done this for both views, you will have altered the defaults. If you have other, custom search views, you may need to edit them as well. And you may need to repeat this when you install updates to Splunk. Fortunately, it is easy to do.

[ChrisG]

In 6.0, use the ui-prefs.conf file. See http://docs.splunk.com/Documentation/Splunk/6.0.1/Search/Selecttimerangestoapply#Change_the_default_....

[JimDeich]

For version 6.0 I put in the changes in Manager » User interface » Views

on but the default still shows as "All time"
Are there other views to be added for Splunk 6 ?