RFE: allow different search timerange based on index

[the_wolverine]

I would like to allow my user to have a longer search timerange (1 year) if searching within summary index.

For main index, I would like to limit search timerange to 30 days.

I hope that the reason for this request is clear but feel free to ask for clarification.

[sowings]

Strictly speaking, I don't know of an easy way to do this on an index basis. However, provided as an Advanced XML module in a couple of the Splunk apps is a module called "HiddenSearchSwapper". This module takes as input the time range selected by the user (via the time picker, usually), and changes the search accordingly. So for example, if you enter "last 15 minutes", it might invoke an adhoc search against the regular raw data. If instead you pick "year to date" (when it's now August), it might substitute in a summary search over weekly-summarized data.

While it's a little bit of extra work to configure, it allows a nice experience for users as they don't have to think about their time range, yet the searches that are run on their behalf can be a bit more efficient, with the additional benefit that the pages load quickly.

If you're working up dashboards for your users, then this module may come in handy. It doesn't apply to the standard search bar, however.

[jonuwz]

oops - my bad - it was timerange, not earliest time.

[jtrucks]

I'm fairly sure the roles and accounts options don't allow for this. You could do something fancy with a UI using the REST API, but that's a huge amount of work.

You could, also, create an account on a search head with the summary index data stored locally on the SH and have the role account only have access to the summary index in question and not regular indexes. Then you could have the user use the indexer for non-summary data, which would be restricted to your 30 day parameters.

[martin_mueller]

I don't think you can OR two earliest values... and even if you could, that'd force people into the most recent 30 days / 12 months, while the role-specific setting allows you to search any 30 day / 12 month range.

[jonuwz]

cant you do this with the custom search limiter ?

(index=main earliest=-30d) OR ( index=summary earliest=-12mon) ?

[the_wolverine]

Yeah, this is the behavior I expected but I was hoping that Splunk might have figured something cool out in version 5.0.x. Maybe we can hope for version 6.0.x

[martin_mueller]

Sneakily assigning two roles with different allowable ranges and one index each will discard the shorter range instead of applying it per index 😞