Good day. Would there be a way to configure a specific index to be searchable for a specific srchTimeWin?
Say the example below.
Splunk User has a user role with a search time win of 1 yr for all non-internal indexes.
We wanted a specific index to be searchable for 2 years only for the same user (the rest by 1yr searchable).
Test already done:
Create a new role and assign to a test user (with the user role) with the new role being searchable to the index of concern with srchTimeWin of 2years. However, all indexes were made searchable to 2 yrs as a result.