https://community.splunk.com/t5/Splunk-Search/How-to-control-search-duration-of-users/m-p/450076#M127451 <P>Also be aware of an entirely new feature in Splunk v7.2 called <CODE>Workload Management</CODE>:</P> <P><A href="https://docs.splunk.com/Documentation/Splunk/7.2.3/Workloads/Aboutworkloadmanagement">https://docs.splunk.com/Documentation/Splunk/7.2.3/Workloads/Aboutworkloadmanagement</A></P> Mon, 11 Feb 2019 07:46:50 GMT woodcock 2019-02-11T07:46:50Z https://community.splunk.com/t5/Splunk-Search/How-to-control-search-duration-of-users/m-p/450068#M127443 <P>Hello Splunkers,</P> <P>I want to put restrictions on the seach time period , right now one user can search for as long as they like..Now i want retrictions on it, lets say 30 min...eg he can search for longer time periods say for 3 months data but his search time shouldn't exceed beyond 30 min.</P> <P>Where should i make this change</P> Sat, 09 Feb 2019 17:06:11 GMT https://community.splunk.com/t5/Splunk-Search/How-to-control-search-duration-of-users/m-p/450068#M127443 ramprakash 2019-02-09T17:06:11Z https://community.splunk.com/t5/Splunk-Search/How-to-control-search-duration-of-users/m-p/450069#M127444 <P>@ramprakash set the TTL values as per your needs: <A href="https://docs.splunk.com/Documentation/Splunk/latest/Admin/Limitsconf#TTL">https://docs.splunk.com/Documentation/Splunk/latest/Admin/Limitsconf#TTL</A></P> Sat, 09 Feb 2019 18:07:37 GMT https://community.splunk.com/t5/Splunk-Search/How-to-control-search-duration-of-users/m-p/450069#M127444 niketn 2019-02-09T18:07:37Z https://community.splunk.com/t5/Splunk-Search/How-to-control-search-duration-of-users/m-p/450070#M127445 <P>Hi @ramprakash ,<BR /> You should configure <CODE>srchMaxTime</CODE> param for the group your user belongs to.<BR /> Like:</P> <PRE><CODE>[user_group] srchMaxTime = 30m </CODE></PRE> <P>This parameter is described in <A href="https://docs.splunk.com/Documentation/ITSI/4.1.1/Configure/authorize.conf">https://docs.splunk.com/Documentation/ITSI/4.1.1/Configure/authorize.conf</A></P> Sat, 09 Feb 2019 18:38:04 GMT https://community.splunk.com/t5/Splunk-Search/How-to-control-search-duration-of-users/m-p/450070#M127445 pkarpushin 2019-02-09T18:38:04Z https://community.splunk.com/t5/Splunk-Search/How-to-control-search-duration-of-users/m-p/450071#M127446 <P>Hi,</P> <P>I would say to use srchTimeWin parameter of authorize.conf if your request is for Splunk Enterprise</P> <P>See :<A href="https://docs.splunk.com/Documentation/Splunk/7.2.3/Security/Addandeditroleswithauthorizeconf">https://docs.splunk.com/Documentation/Splunk/7.2.3/Security/Addandeditroleswithauthorizeconf</A></P> <P>The answer of @pkarpushin seems to be for ITSI.</P> Sat, 09 Feb 2019 20:30:19 GMT https://community.splunk.com/t5/Splunk-Search/How-to-control-search-duration-of-users/m-p/450071#M127446 cmahieu 2019-02-09T20:30:19Z https://community.splunk.com/t5/Splunk-Search/How-to-control-search-duration-of-users/m-p/450072#M127447 <P>Hi,</P> <P>I sugest to use srchTimeWin parameter of authorize.conf which defines per role the maximum time span in seconds allowed for a search executed by a user in this role.</P> <P>Source : <A href="https://docs.splunk.com/Documentation/Splunk/7.2.3/Security/Addandeditroleswithauthorizeconf">https://docs.splunk.com/Documentation/Splunk/7.2.3/Security/Addandeditroleswithauthorizeconf</A></P> <P>Christian</P> Sat, 09 Feb 2019 20:34:51 GMT https://community.splunk.com/t5/Splunk-Search/How-to-control-search-duration-of-users/m-p/450072#M127447 cmahieu 2019-02-09T20:34:51Z https://community.splunk.com/t5/Splunk-Search/How-to-control-search-duration-of-users/m-p/450073#M127448 <P>Thanks pkarpushin</P> Sun, 10 Feb 2019 06:33:13 GMT https://community.splunk.com/t5/Splunk-Search/How-to-control-search-duration-of-users/m-p/450073#M127448 ramprakash 2019-02-10T06:33:13Z https://community.splunk.com/t5/Splunk-Search/How-to-control-search-duration-of-users/m-p/450074#M127449 <P>Thanks @cmahieu ..if my query discontinue after lets say 30 min then will i get latest or earliest events ?</P> Sun, 10 Feb 2019 06:34:25 GMT https://community.splunk.com/t5/Splunk-Search/How-to-control-search-duration-of-users/m-p/450074#M127449 ramprakash 2019-02-10T06:34:25Z https://community.splunk.com/t5/Splunk-Search/How-to-control-search-duration-of-users/m-p/450075#M127450 <P>I would say that if users consistently have searches that run for over 30 minutes, you have other issues to address in the platform. </P> Sun, 10 Feb 2019 21:24:02 GMT https://community.splunk.com/t5/Splunk-Search/How-to-control-search-duration-of-users/m-p/450075#M127450 ddrillic 2019-02-10T21:24:02Z https://community.splunk.com/t5/Splunk-Search/How-to-control-search-duration-of-users/m-p/450076#M127451 <P>Also be aware of an entirely new feature in Splunk v7.2 called <CODE>Workload Management</CODE>:</P> <P><A href="https://docs.splunk.com/Documentation/Splunk/7.2.3/Workloads/Aboutworkloadmanagement">https://docs.splunk.com/Documentation/Splunk/7.2.3/Workloads/Aboutworkloadmanagement</A></P> Mon, 11 Feb 2019 07:46:50 GMT https://community.splunk.com/t5/Splunk-Search/How-to-control-search-duration-of-users/m-p/450076#M127451 woodcock 2019-02-11T07:46:50Z https://community.splunk.com/t5/Splunk-Search/How-to-control-search-duration-of-users/m-p/450077#M127452 <P>An hadoop-like approach... </P> Mon, 11 Feb 2019 11:56:18 GMT https://community.splunk.com/t5/Splunk-Search/How-to-control-search-duration-of-users/m-p/450077#M127452 ddrillic 2019-02-11T11:56:18Z https://community.splunk.com/t5/Splunk-Search/How-to-control-search-duration-of-users/m-p/450078#M127453 <P>Should srchMaxTime work with data models and tstats? See my question at: <A href="https://answers.splunk.com/answers/738545/trying-to-limit-search-duration-with-srchtimewin-a.html">https://answers.splunk.com/answers/738545/trying-to-limit-search-duration-with-srchtimewin-a.html</A></P> Wed, 03 Apr 2019 15:07:09 GMT https://community.splunk.com/t5/Splunk-Search/How-to-control-search-duration-of-users/m-p/450078#M127453 simpkins1958 2019-04-03T15:07:09Z