Search within a limited time frame

By default, the Search & Reporting app's time range is set to Last 24 hours. Searches done using the All Time time frame will generally perform slower based on the volume and relative quantity of how much historical data is in the index. This problem grows when there are concurrent users doing the same thing. Although you can train your users to select a limited time range, not everybody will do this.

If you want to make the time range even shorter by default, you can simply change the default time range from the drop-down menu. We will do this by modifying the ui-prefs.conf file in an administrative Command Prompt.

Edit the following file:

SPLUNK_HOME/etc/system/local/ui-prefs.conf

Copy and paste the following into the file:

[search] 
dispatch.earliest_time = -4h 
dispatch.latest_time = now 
          
[default] 
dispatch.earliest_time = -4h 
dispatch.latest_time = now 

Save the file and restart Splunk. Go back to the Search & Reporting app and the default...