Hi ebele, you have epoch timestamps in your sample data. If you want the the timestamps to display as human readable dates, use an   ... | eval human_earliest=strftime(earliest_date,"%c") | ...    If you have a dashboard with a time range picker that populates a token called "time_selection" and would like to  have your search to deliver only the events in the selected time range add the following to your search:   ...| where earliest_date>=$time_selection.earliest$ AND latest_date<$time_selection.latest$ | ...   Last, but not least, if you would like to honor the timestamps in your standard search bar, using the standard time selector on the right of the splunk search field... add the following to your search: ...| addinfo | where earliest_time>=info_min_time AND latest_time<info_max_time | ... I assume that you only want those KPIs that have both, the earliest and the latest time inside the time range. You may need to tweak that to meet your requirements. Hope it helps, Oliver ... View more