This is a simple request, but the official docs are out of date.
- Create a file: $SPLUNK_HOME/etc/apps/search/local/ui-prefs.conf
- Create a search stanza like this:
[search]
dispatch.earliest_time = -7d@d
dispatch.latest_time = now
Restart Splunk and you’re good to go!