https://community.splunk.com/t5/Getting-Data-In/Restrict-search-time-window-for-metric-index/m-p/548131#M91159 <P>attached the solution which worked for the event index&nbsp;<A href="https://community.splunk.com/t5/Dashboards-Visualizations/Limit-how-far-back-you-can-retrieve-data-regardless-of/td-p/51257" target="_blank">https://community.splunk.com/t5/Dashboards-Visualizations/Limit-how-far-back-you-can-retrieve-data-regardless-of/td-p/51257</A></P> Fri, 16 Apr 2021 03:19:13 GMT wangjianiu 2021-04-16T03:19:13Z https://community.splunk.com/t5/Getting-Data-In/Restrict-search-time-window-for-metric-index/m-p/548130#M91158 <P>I set the "<STRONG>Restrict search time range"&nbsp;</STRONG>in the role configuration to 3 days, now for the event index, Splunk only returns 3 days of data, base on the latest time user selected. but for metric search(mstats), it still returns data for a longer period(base on user's selection), wonder if the restriction only works for event index? or is there any other way I could restrict the search window for metric search?&nbsp;</P> Fri, 16 Apr 2021 03:08:58 GMT https://community.splunk.com/t5/Getting-Data-In/Restrict-search-time-window-for-metric-index/m-p/548130#M91158 wangjianiu 2021-04-16T03:08:58Z https://community.splunk.com/t5/Getting-Data-In/Restrict-search-time-window-for-metric-index/m-p/548131#M91159 <P>attached the solution which worked for the event index&nbsp;<A href="https://community.splunk.com/t5/Dashboards-Visualizations/Limit-how-far-back-you-can-retrieve-data-regardless-of/td-p/51257" target="_blank">https://community.splunk.com/t5/Dashboards-Visualizations/Limit-how-far-back-you-can-retrieve-data-regardless-of/td-p/51257</A></P> Fri, 16 Apr 2021 03:19:13 GMT https://community.splunk.com/t5/Getting-Data-In/Restrict-search-time-window-for-metric-index/m-p/548131#M91159 wangjianiu 2021-04-16T03:19:13Z