Hi fellow Splunkers,
Good day. Would there be a way to configure a specific index to be searchable for a specific srchTimeWin?
Say the example below.
Scenario:
Splunk User has a user role with a search time win of 1 yr for all non-internal indexes.
We wanted a specific index to be searchable for 2 years only for the same user (the rest by 1yr searchable).
Test already done:
Create a new role and assign to a test user (with the user role) with the new role being searchable to the index of concern with srchTimeWin of 2years. However, all indexes were made searchable to 2 yrs as a result.
Thanks in advance.
Kind Regards,
Ariel
You can restrict a user to have additional limitations to his/her search.
But as far as I remember it's configured on a per-user basis, you can't set it to differentiate between indexes.