Is there be a way to configure a specific index to be searchable for a specific srchTimeWin?

[arielpconsolaci]

Hi fellow Splunkers,

Good day.  Would there be a way to configure a specific index to be searchable for a specific srchTimeWin?

Say the example below.

Scenario:

Splunk User has a user role with a search time win of 1 yr for all non-internal indexes.

We wanted a specific index to be searchable for 2 years only for the same user (the rest by 1yr searchable).

Test already done:

Create a new role and assign to a test user (with the user role) with the new role being searchable to the index of concern with srchTimeWin of 2years. However, all indexes were made searchable to 2 yrs as a result.

Thanks in advance.

Kind Regards,

Ariel

[PickleRick]

You can restrict a user to have additional limitations to his/her search.

https://docs.splunk.com/Documentation/Splunk/8.2.4/Security/Addandeditroles#Specify_default_app_and_...

But as far as I remember it's configured on a per-user basis, you can't set it to differentiate between  indexes.