All Apps and Add-ons
Highlighted

Restricting searches that are too open

Path Finder

In order to lower the IOPS, I would like to restrict a specifc user role to search by index AND source type. in addition I would like to restrict things like "all time" searches to only power users. not sure what to put in the "Restrict search terms" field of the role. can someone help or point me in the right direction?

0 Karma
Highlighted

Re: Restricting searches that are too open

Motivator

Indexes you can select farther down the form

Here is an example of restricting to 2 sourcetypes
"sourcetype=mySourceType OR sourcetype=myothersourcetype"

Here is a post with someone having a similar request:
http://answers.splunk.com/answers/75912/restrict-search-terms-conditionally-depending-on-the-index-b...

Highlighted

Re: Restricting searches that are too open

Path Finder

is it possible to take away the "all time" away?

0 Karma
Highlighted

Re: Restricting searches that are too open

Motivator
0 Karma
Highlighted

Re: Restricting searches that are too open

SplunkTrust
SplunkTrust

You can restrict roles to a certain time span by setting "Restrict search time range" to a number of seconds. Say you set that to 864000 (ten days) and someone selects "All time" the search will cut off at May 11th, 14:40 UTC - ten days into the past. If someone selects "past year" it will load December 22nd 00:00 through December 31st 24:00.

If you visually want to remove the "All time" shortcut from the time range picker you can always restrict its visibility to certain roles only (Settings -> User interface -> Time ranges), but that alone isn't going to stop anyone from launching an all time search manually by setting earliest=0 latest=now in the search.

0 Karma