By default, the Search & Reporting app's time range is set to Last 24 hours. Searches done using the All Time time frame will generally perform slower based on the volume and relative quantity of how much historical data is in the index. This problem grows when there are concurrent users doing the same thing. Although you can train your users to select a limited time range, not everybody will do this.
If you want to make the time range even shorter by default, you can simply change the default time range from the drop-down menu. We will do this by modifying the ui-prefs.conf file in an administrative Command Prompt.
Edit the following file:
SPLUNK_HOME/etc/system/local/ui-prefs.conf
Copy and paste the following into the file:
[search]
dispatch.earliest_time = -4h
dispatch.latest_time = now
[default]
dispatch.earliest_time = -4h
dispatch.latest_time = now
Save the file and restart Splunk. Go back to the Search & Reporting app and the default time range should now say Last 4 hours. Note that this will also change the default time range in the Search dashboard of the Destinations app since any change in the default will be automatically applied to all apps, unless specified otherwise.