Splunk Search

Can search time limit be applied by index?

timgren
Explorer

Can a search time limit be applied differently by index rather than by role? 


Currently, we have a search roll limit of 6 weeks. However, this limit defeats the purpose of summary indexing which are often required to examine a much longer spread.

Any thoughts or work-arounds? 

timgren_0-1642453405506.png

 



Labels (1)
Tags (3)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

No, search time limits cannot be applied by index.

Perhaps Workload Management Admission Rules will help.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Introducing Ingest Actions: Filter, Mask, Route, Repeat

WATCH NOW Ingest Actions (IA) is the best new way to easily filter, mask and route your data in Splunk® ...

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...