topic I need to set 24hours default search intervals for user role in Splunk Search

I need to set 24hours default search intervals for user role

jayakumar89 — Wed, 05 Apr 2017 17:58:37 GMT

We have 3 custom roles (user, power user and admin) and i would like to set 24hours as default search interval or block all time option only for all users who are mapped to user role. Any help would be appreciated.

TIA
Jay

Re: I need to set 24hours default search intervals for user role

adonio — Wed, 05 Apr 2017 18:08:38 GMT

Hi jayakumar89,
using the setting highlighted in the attached picture you can prevent from users under a certain role from searching past a certain time
you can also set ui-pref.conf to set default search time. some related answers here:
https://answers.splunk.com/answers/106136/how-to-set-the-default-search-time-in-splunk-6.html
https://answers.splunk.com/answers/105781/splunk-6-0-default-time-in-time-picker.html
more on ui-pref.conf here:
https://docs.splunk.com/Documentation/Splunk/6.5.2/Admin/Ui-prefsconf![alt text]1

Re: I need to set 24hours default search intervals for user role

jayakumar89 — Wed, 05 Apr 2017 18:53:32 GMT

Thanks for the info. Is it possible to make users does not have All time option at all ?

Re: I need to set 24hours default search intervals for user role

woodcock — Wed, 05 Apr 2017 19:05:12 GMT

Yes, you create a .../local/times.conf that has this content:

[all_time]
disabled = 1