To restrict searching on indexed data till a predefined timestamp

[sajeeshpn]

Hi,

Is there any configuration option/method in Splunk where we can restrict the searching on the indexed data (all indexes) only till a predefined timestamp. So that all the searches (including dashboards/reports) should be applied only to the data indexed till that predefined time and not afterward.

Hope for an answer soon.

Thanks,
Sajeesh

[sloshburch]

Tell us more about the reason? Why is the normal time constraints insufficient?

Meanwhile, these fields might be what you're looking for:

• _indextime: Similar to _time but relative to when the event was indexed rather than when the event occurred
• _index_earliest: Specify the earliest _indextime for the time range of your search.
• _index_latest: Specify the latest _indextime for the time range of your search.

Learn more:

• Basic Time Modifiers: http://docs.splunk.com/Documentation/Splunk/latest/Search/Specifytimemodifiersinyoursearch
• Advanced Time Modifiers: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/SearchTimeModifiers

[kmorris_splunk]

One solution might be to add a calculated field that contains the date that you want it searchable til. Then, in your role definition, create a search restriction, where the current time is less than or equal to that field.

[sajeeshpn]

Anybody knows an answer for this?

Thanks,
Sajeesh

[whrg]

This is probably not the answer you were looking for, but you have the option to "Restrict search time range" on a per role basis:
"Set a maximum time window (in seconds) for searches for this role. For example, set this to '60' to restrict this role's searches to 1 minute before the most recent time specified in the search. You can also set this to '0' to explicitly make the window infinite, or '-1' to unset the window for this role (can be overridden by imported roles)."