Is there a way to limit data acceleration time options? For example, to prevent All Time.


I have noticed that I have some users in the environment that are selecting 'All Time' by default on data acceleration. The problem is that some of these users have long term data retention and very expensive searches. I was hoping there was a way to limit the max time range used for acceleration.

For now I have set up some alerts to notify me when someone is using "All Time"

0 Karma
Get Updates on the Splunk Community!

Happy CX Day, Splunk Community!

Happy CX Day, Splunk Community! CX stands for Customer Experience, and today, October 3rd, is CX Day — a ...

Splunk Observability Cloud | Customer Survey!

If you use Splunk Observability Cloud, we invite you to share your valuable insights with us through a brief ...

.conf23 | Get Your Cybersecurity Defense Analyst Certification in Vegas

We’re excited to announce a new Splunk certification exam being released at .conf23! If you’re going to Las ...