HEC Analytics Custom Queries

[Mark_Edwards]

Hi,

When running a custom query it seems to only go back 6 months or so despite selecting a year.

Is this because of the default Email Meta Data retention period of 180 days as per Appendix G of the admin guide?

e.g. A custom Query for Emails containing Malware will go back to July 2025 while the Security Events Dashboard with 12 months selected and filtering on Malware will reflect all Malware events for the year. 

Just wondering why the difference as we have a customer who wants to get reports via Custom Queries for the whole year. 

Thanks.