This is not really possible, and in Splunk 4.0 is not necessary, as this is handled automatically within an index.
In Splunk 4.0, each index can have multiple hot buckets, and data will be placed into a hot bucket according to where it fits in time. The exact time differential is determined by a combination of index settings (in indexes.conf) and automatic determinations by Splunk (which in turn is determined by the timestamp ranges of incoming data).
In Splunk 4.0, the default hot bucket has a maximum time range of 90 days, but in most uses, Splunk will keep buckets to a much narrower range than that. Furthermore, there are quarantine buckets that are intended to capture all data older than or farther in the future than some other settings, to keep it from polluting the index too badly (e.g., all data from 7 years ago and all data from 10 years ago will go into the same quarantine bucket, even though they are more than 90 days apart).
Generally, you do not need to adjust these settings, provided you use the same index settings as the main index, which can have up to 10 hot buckets. The effect is that your bucket spans will stay narrow and you will not get overlapping buckets (except under extremely pathological conditions, like your data sending in timestamps from 11 different times that are each spaced out more than 90 days from each other -- this usually only happens if you're loading archived data, which calls for more control and a separate index anyway)
... View more