How to change the default search time range in Splunk 6

Categories: 

This is a simple request, but the official docs are out of date.

  1. Create a file: $SPLUNK_HOME/etc/apps/search/local/ui-prefs.conf
  2. Create a search stanza like this:

    [search]
    dispatch.earliest_time = -7d@d
    dispatch.latest_time = now

Restart Splunk and you're good to go!