Issue with my search query

[GattyBiggz]

Greeting,

I am trying to identify users who have not had any activity in O365 for over 180 days, however my search is pulling old logs and listing users based on those old longs but when I got into events I can see logs from some of those users that are not over 180 days old. How do I fix this issue. 

[PickleRick]

It's not clear what is your situation but as I understand it you're pulling some logs into Splunk. And while the source logs are supposed to cover longer timespan you're not able to list events older than 180 days. Is that so?

The two most typical issues might be that either your index has short retention period and older events are rolled to frozen or your user is limited to searching for only 180 days back.