cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
Ask a Question
splunkjpm
New Member
Member since: ‎03-20-2013
‎06-05-2020
Community Statistics
Posts 4
Solutions 0
Karma Given 0
Karma Received 0
Member Since ‎03-20-2013
Activity Feed
View All

Re: how can I change the default search time for a...

by in Splunk Search
‎01-29-2014 08:50 AM
‎01-29-2014 08:50 AM
yes i did restart splunk but when app comes up it still shows all time, I did notice serveral reference to this change related to version 6 can you please confirm if this change is supported in 5.0.5 the version we are running on . Also to clarify we want the default for the search for this custom app for all user to be 4 hrs, not all time, even if they change the search time the next they access the custom app the default time that appears on the screen next to the search bar should be 4 hrs ... View more

Re: how can I change the default search time for a...

by in Splunk Search
‎01-28-2014 03:01 PM
‎01-28-2014 03:01 PM
Thank you for the suggestion, since the ui-prefs.conf file did not exists in $SPLUNK_HOME/etc/system/default i created in in the default directory for my app and added in lines dispatch.earliest_time = -4h@h dispatch.latest_time = now unfortunately it still does not work, when i access the app on the search bar it still has a default value of all time for the searches I dont know if this mattr but we are running version 5.0.5 any other suggestions would be appreciated ... View more

how can I change the default search time for all u...

by in Splunk Search
‎01-28-2014 11:56 AM
‎01-28-2014 11:56 AM
I would like to change the default search time for all users who select the custom app i have created from all time to only search by default the last 4 hrs. How can i make this change so that all users who select this custom app from their app dropdown menu will automatically get a default of 4 hrs for all searches they request, not all time? ... View more

data retention for an index how to control archivi...

by in Knowledge Management
‎01-09-2014 12:29 PM
‎01-09-2014 12:29 PM
We have several indexes where we have set the maxTotalDataSIzeMB to a specific value is it also possible to configure the frozenTimePeriodInSecs for the same indexes. Can you have both paramters configured for the same index and if so which one takes priority in determining when to delete data is it the size of index or age of the date. For our purpose we are first looking for data to roll off if it exceed 30 days old and as a second check if data is less than 30 days old but index size is greater than 10 GB dta should roll off ... View more
Contact Me
Online Status
Offline
Date Last Visited
‎06-05-2020 02:04 AM