I too have this question. It appears the behaviour has changed between v6 and v7 of Splunk. Before it was always "between" for the "date range" and "time & date range" sub menus, now it seems to depend on how the underlying selected time stanza is constructed ie if it has latest=now ie "last 60 minutes" then this button is "since", if it is relative ie "yesterday" then it defaults to the "between" button.
The behaviour between the timepicker in the Search App compared to a dashboard now differs in version 7x., which is somewhat annoying.
I would like to know how for a given times.conf stanza you can potentially control what the button behaviour is in the "date range" and "time & date range" sub menus.
It also appears a lot of what is now in the documentation for times.conf no longer works ie sub menu options, [settings] option etc. IT would be good if this was sorted to save people wasting time.
... View more