Documentation > Splunk > Admin Manual > Change the Default Time Range

Admin Manual

 


Overview
Setting Up Data Inputs
Authentication
Changing the Way Splunk Processes Your Data
Creating and Using Configuration Bundles
Configuring Your Sources
Splunk-2-Splunk Management
Integration
Managing Your Filesystem
How-To's

Change the Default Time Range

This documentation does not apply to the most recent version of Splunk. Click here for the latest version.

Change the Default Time Range

If you want Splunk to change the default search behavior to a specific time range you will need to edit $SPLUNK_HOME/share/splunk/search/dynamic/html/main_ui.html


Add the selected attribute to the popup element you want defulted and add the value to the "relStartTimeUnit"


For example, if you wanted to set the default to "6 hours ago" you would change the following: 


<div class="#productVersion#Version landingPageState #userType#User noTimeFields 
eventsTab relativeTimeMode #dynamicallySetStates#" id="outerWrapper" />

to 


<div class="#productVersion#Version landingPageState #userType#User eventsTab 
relativeTimeMode #dynamicallySetStates#" id="outerWrapper" />

This removes the "noTimeFields" state so the time controls are now open by default


Change the relative start time by changing: 


<input type="text" id="relStartTime" />

to 


<input type="text" value="6" id="relStartTime" />

The UI will load with "6" already entered into the relative start field


Change the realtive start unit by changing 


<option value="hours">Hours ago</option>

to 


<option value="hours" selected="selected">Hours ago</option>

This means that hours will be selected by default, instead of minutes

Retrieved from "http://docs.splunk.com/Documentation/Splunk/2.2.3/Admin/ChangeTheDefaultTimeRange"

This documentation applies to the following versions of Splunk: 2.2 , 2.2.1 , 2.2.3 , 2.2.6 View the Article History for its revisions.


You must be logged into splunk.com in order to post comments. Log in now.

Was this documentation topic helpful?

If you'd like to hear back from us, please provide your email address:

We'd love to hear what you think about this topic or the documentation as a whole. Feedback you enter here will be delivered to the documentation team.

Feedback submitted, thanks!