According to indexes.conf you can't set it to lower then 3600 seconds.
Well ok you can .. but:
If you set this parameter to less than
3600, it will be automatically reset
to 3600, which will then activate
snapping behavior
... View more
note:
Configuring the dispatch.earliest_time over the UI like shown in the post above
will set the [general_default] stanza in user-prefs.conf (so not in ui-prefs.conf)
(seen/verified in splunk 7.1.6)
... View more