Restricting searches that are too open

[mkarimi]

In order to lower the IOPS, I would like to restrict a specifc user role to search by index AND source type. in addition I would like to restrict things like "all time" searches to only power users. not sure what to put in the "Restrict search terms" field of the role. can someone help or point me in the right direction?

[martin_mueller]

You can restrict roles to a certain time span by setting "Restrict search time range" to a number of seconds. Say you set that to 864000 (ten days) and someone selects "All time" the search will cut off at May 11th, 14:40 UTC - ten days into the past. If someone selects "past year" it will load December 22nd 00:00 through December 31st 24:00.

If you visually want to remove the "All time" shortcut from the time range picker you can always restrict its visibility to certain roles only (Settings -> User interface -> Time ranges), but that alone isn't going to stop anyone from launching an all time search manually by setting earliest=0 latest=now in the search.

[aelliott]

Indexes you can select farther down the form

Here is an example of restricting to 2 sourcetypes
"sourcetype=mySourceType OR sourcetype=myothersourcetype"

Here is a post with someone having a similar request:
http://answers.splunk.com/answers/75912/restrict-search-terms-conditionally-depending-on-the-index-b...

[aelliott]

you could say earliest=
http://docs.splunk.com/Documentation/Splunk/6.0.2/Search/Specifytimemodifiersinyoursearch

Here's a post on that as well: http://answers.splunk.com/answers/57684/limit-how-far-back-you-can-retrieve-data-regardless-of-timer...

[mkarimi]

is it possible to take away the "all time" away?