Splunk Search

default search timeframes

Champion

I tried doing this, and it worked for the Summary view, but once I picked on a specific source or sourcetype, it went back to "All Time". Is there a way to change the default so that when I go from Summary to an individual source/sourctype, it won't be "All Time"?

Tags (2)
0 Karma

Engager

This can also be set on a per-user basis in the etc/users//search/local/viewstates.conf file:

[flashtimeline:_current]
TimeRangePicker_0_1_0.default = Last 15 minutes

[dashboard_live:_current]
TimeRangePicker_0_1_0.default = Last 4 hours

Legend

You need to change this in all of the search views. For Splunk 4.3, there are two default search views in the Search app.

Look under Manager » User interface » Views and choose the App Context "search".
You should see a view named "flashtimeline" and a view named "dashboard_live". (BTW, dashboard_live is the name of the Summary view.)

Edit each view by clicking on its name. Look for the two lines

<module name="TimeRangePicker">
    <param name="selected">All time</param>

Change All time to the default time range of your choice. Spell it exactly as it appears in the time range picker drop-down. For example

<module name="TimeRangePicker">
    <param name="selected">Last 60 minutes</param>

Save your edits.

When you have done this for both views, you will have altered the defaults. If you have other, custom search views, you may need to edit them as well. And you may need to repeat this when you install updates to Splunk. Fortunately, it is easy to do.

Splunk Employee
Splunk Employee

Path Finder

For version 6.0 I put in the changes in Manager » User interface » Views

on but the default still shows as "All time"
Are there other views to be added for Splunk 6 ?

0 Karma