in DevOps Culture by
How to set the default search time in Splunk 6?

1 Answer

0 votes
To do this in Splunk Enterprise 6.0, we have to use ‘ui-prefs.conf’. If we set the value in the following, all our users would see it as the default setting:


For example, if our

$SPLUNK_HOME/etc/system/local/ui-prefs.conf file



dispatch.earliest_time = @d

dispatch.latest_time = now

The default time range that all users will see in the search app will be today.

The configuration file reference for ui-prefs.conf is here: