Dashboards & Visualizations

How do I set the default time range for the search bar of the search app's summary view?

Simeon
Splunk Employee
Splunk Employee

I want to change my default time range to search the last 15 minutes instead of all time. How could I go about doing this?

Tags (2)
1 Solution

Simeon
Splunk Employee
Splunk Employee

To change the default setting for the Search app, you must edit the TimeRangePicker module within its respective view.

http://docs.splunk.com/Documentation/Splunk/5.0/AdvancedDev/ModuleReference

To edit this, log in to Splunk and navigate to manager > views > charting. This should take you directly to a window where you can make direct xml edits. You will need to change the TimeRangePicker selected parameter to match one that is used in the times.conf file. The specific lines are:

   <module name="TimeRangePicker">
      <param name="selected">All time</param>

You may only populate the parameter with valid "label" values. Values can be found in the $SPLUNK_HOME/etc/system/default/times.conf file. So, if I wanted to use the last 15 mins as my default, I would make the following change to the selected parameter (case sensitive):

   <module name="TimeRangePicker">
      <param name="selected">Last 15 minutes</param>

Be aware that you should also change this for the charting view. So, after saving the previous change you should navigate to charting.

If you wanted to do this via CLI, you could manually recreate these files and place them in a local directory under the search app. The default files for the views are physically located here:

$SPLUNK_HOME/etc/apps/search/default/data/ui/views

The files that need to be edited are flashtimeline.xml and charting.xml.

View solution in original post

bmunson_splunk
Splunk Employee
Splunk Employee

This has changed in version 6 of splunk. You can now do this in ui-prefs.conf

http://docs.splunk.com/Documentation/Splunk/6.1.1/Search/Selecttimerangestoapply#Change_the_default_...

Simeon
Splunk Employee
Splunk Employee

To change the default setting for the Search app, you must edit the TimeRangePicker module within its respective view.

http://docs.splunk.com/Documentation/Splunk/5.0/AdvancedDev/ModuleReference

To edit this, log in to Splunk and navigate to manager > views > charting. This should take you directly to a window where you can make direct xml edits. You will need to change the TimeRangePicker selected parameter to match one that is used in the times.conf file. The specific lines are:

   <module name="TimeRangePicker">
      <param name="selected">All time</param>

You may only populate the parameter with valid "label" values. Values can be found in the $SPLUNK_HOME/etc/system/default/times.conf file. So, if I wanted to use the last 15 mins as my default, I would make the following change to the selected parameter (case sensitive):

   <module name="TimeRangePicker">
      <param name="selected">Last 15 minutes</param>

Be aware that you should also change this for the charting view. So, after saving the previous change you should navigate to charting.

If you wanted to do this via CLI, you could manually recreate these files and place them in a local directory under the search app. The default files for the views are physically located here:

$SPLUNK_HOME/etc/apps/search/default/data/ui/views

The files that need to be edited are flashtimeline.xml and charting.xml.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...