You will have to edit the saved search and see what the time window is that it's using and change that. However, if you change the search it will change it for all people who are using that search.  ... View more

When you use loadjob the indexers return ALL results from your saved search. Anything you do with the data after loadjob such as display fields, stats, etc. will be run against the entire result set. Additionally, anytime the dashboard page is refreshed, visited by another user, or re-visited, etc. then the loadjob is called again each time. If your artifact bundle is huge, as you state, then you're definitely going to hit performance and storage issues. You might consider modifying your savedsearch to limit the results, or break it down into multiple saved searches. Or, you can build a search directly in the dashboard and use the results as a "base" search. This post has a good discussion on it: https://community.splunk.com/t5/Splunk-Search/Base-search-query-for-different-dashboard-panels/m-p/309255 ... View more

Thank you very much!  Your second example works perfect for every incident_id of all queues... this is even better.  I appreciate your help! ... View more