About the searchable time range of data

By default, users can search data for all hours that have been ingested into Splunk.

If you want to limit the time range of searchable data for each user, you can set it in the following way.

Searchable time range setting method

• Go to SplunkWeb and select Settings > Access Control > Roles > New.
• Enter the role name, and in "Restriction of search time range", enter the time range in seconds that you want to be searchable.
  *For example, enter 604800 if you want to be able to search data for the past 7 days.
• Select the save button.
• From Settings > Access Control > Users, select the users whose time range you want to search.
• From "Assign to role", assign the created role and save.