Splunk Enterprise Security

Splunk ES Incident Review Dashboard Default Search Time Settings

tezkpk
Engager

I am a Splunk ES (enterprise security) user, looking to change the default search time setting for all users on the Incident Review dashboard. By default, it is set to search "All Time." I would like to change it to search the last 24 hours. I have tried editing the XML of the dashboard and looked into the JavaScript, which powers the dashboard, but nothing that I have tried changes the default search time for users.

It appears that the time is sent into the url as parameters (earliest=0&latest= which searches All Time). Has anyone seen the settings, whether it be through the GUI, or through the CLI, on how to change the default search time setting for the Incident Review dashboard?

0 Karma
1 Solution

LukeMurphey
Champion

This was fixed in newer versions of ES. ES 4.5.0, 4.2.2, 4.1.3, and 4.0.5 do not default to an all-time search.

View solution in original post

LukeMurphey
Champion

This was fixed in newer versions of ES. ES 4.5.0, 4.2.2, 4.1.3, and 4.0.5 do not default to an all-time search.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...