How to alert a user when his maximum time window is excedeed


I created a specific role for some users with a defined maximum time window. Hence, these users are not allowed to search for more tha 7 days.
As specified in the docs,

srchTimeWin = <integer>
* Maximum time span, in seconds, of a search.
* This time window limit is applied backwards from the latest time
   specified in a search.

The problem is that when time window specified in the search is greater than the maximum time window, there are no messages that can warn the user that his search time window has been reduced.

Is there a way to display an error or a message when this happens ?

0 Karma


This is what I would do as an alternative solution

Method 1:
1) go to localhost:8000/en-US/manager/launcher/data/ui/times
2) define custom time ranges for the roles
3) update the sharing permissions for other time ranges to exclude that role type

This will only display the time ranges that are available to the role

Method 2 (greater flexibility):
On the default app for the user, write up instructions about the capabilities each role has.
You can display the capability information panel based on the role type by executing a rest search

0 Karma



Thanks for your help, but these solutions cannot be applied to my case...

About method 1, the users need to perform historical searches (between this date time and this one, not just the last 24hours for example)
About method 2, I assume my users can easily forget what they read, and I dont want to be in the case where you ignore a message when you see it daily

The best mitigation I found for now is a custom dashboard where the user inputs the start date, select the search duration (1hour, 24 hours, etc), and then enter his query. The dashboard then specify the earliest and latest tags based on the user input, and then feed the user's query

Get Updates on the Splunk Community!

Security Highlights: September 2022 Newsletter

 September 2022 The Splunk App for Fraud Analytics (SFA) is now Splunk SupportedUse your existing Splunk ...

Platform Highlights | September 2022 Newsletter

 September 2022 What’s New in 9.0 and How to UpgradeGet a walk through of what is new Splunk Enterprise 9.0 ...

Observability Highlights | September 2022 Newsletter

 September 2022 Splunk Observability SuiteAccess to "Classic" SignalFx Interface Will be Removed on Sept 30, ...