I believe it should be done with maxHotSpanSecs parameter in indexes.conf https://docs.splunk.com/Documentation/Splunk/latest/Admin/Indexesconf maxHotSpanSecs = <positive integer>
* Upper bound of timespan of hot/warm buckets, in seconds.
... View more