I have a dashboard where the user can select the time range using Splunk's xml tag 'time'. But out-of-the-box this provides all the capabilities where the user can fetch the data even for 30 days.
But, I want to restrict the time window to only 3 days. How can this be achieved?