Set defaults for the Events page for all users.

Default lookback period

Set a default lookback period to show events from a certain time range, based on the event creation date, each time users visit the Events page. This default value you set here applies to all users. By default, this time range is set to the last 7 days.

When setting the default value, consider the following two points:

• Load enough data to show metrics

• Target the amount of data to streamline resource usage

During a session, users can select a different lookback period by choosing either a preset or a custom time range, overriding the default lookback period for that session. If the user logs out or leaves the Events page, when they return to the Events page, the lookback period reverts to the default setting.

To set a default lookback period for the Events page, follow these steps

1. From the main menu, select Administration. Select Event Settings, then Display Preferences.

2. On the Display Preferences page, select the default time setting you want to use for all users. Choices include time frames ranging from the last 24 hours to 30 days to All Time

   Note: The All Time range returns all event data created since you first started using Splunk SOAR, which can be an enormous amount of data. Avoid using the All Time range to avoid placing a heavy load on your Splunk SOAR instance.

   .

You can change this setting at any time.

For details on how users view the Events page, see Events lookback period in the Use Splunk SOAR (Cloud) documentation.