https://community.splunk.com/t5/Getting-Data-In/Issue-with-my-search-query/m-p/753799#M119668 <P>Greeting,</P><P>I am trying to identify users who have not had any activity in O365 for over 180 days, however my search is pulling old logs and listing users based on those old longs but when I got into events I can see logs from some of those users that are not over 180 days old. How do I fix this issue.&nbsp;</P> Tue, 30 Sep 2025 21:50:57 GMT GattyBiggz 2025-09-30T21:50:57Z https://community.splunk.com/t5/Getting-Data-In/Issue-with-my-search-query/m-p/753799#M119668 <P>Greeting,</P><P>I am trying to identify users who have not had any activity in O365 for over 180 days, however my search is pulling old logs and listing users based on those old longs but when I got into events I can see logs from some of those users that are not over 180 days old. How do I fix this issue.&nbsp;</P> Tue, 30 Sep 2025 21:50:57 GMT https://community.splunk.com/t5/Getting-Data-In/Issue-with-my-search-query/m-p/753799#M119668 GattyBiggz 2025-09-30T21:50:57Z https://community.splunk.com/t5/Getting-Data-In/Issue-with-my-search-query/m-p/753815#M119670 <P>It's not clear what is your situation but as I understand it you're pulling some logs into Splunk. And while the source logs are supposed to cover longer timespan you're not able to list events older than 180 days. Is that so?</P><P>The two most typical issues might be that either your index has short retention period and older events are rolled to frozen or your user is limited to searching for only 180 days back.</P> Wed, 01 Oct 2025 07:03:35 GMT https://community.splunk.com/t5/Getting-Data-In/Issue-with-my-search-query/m-p/753815#M119670 PickleRick 2025-10-01T07:03:35Z