restrict the search for specific time

[gowthammahes]

Hello Everyone,

I have a requirement that the data can be searchable upto last 30 days in search page. But the index retention period is 90 days. Basically it should allow the user to search only between last 30 days events and if it is required then allow the user to search for 90 days.  Is there any configuration available to make the data searchable and not searchable in splunk.

Thanks in advance

[gcusello · Accepted solution]

Hi @gowthammahes ,

if you want to limit the time access for some users, you can apply a limit to the role of these users.

Ciao.

Giuseppe