SaaS
Component : CA DOI Foundations
SAAS retention is only 15 days and not 30 days. You should perform a filtered search on more than 7 days and disable the aggregation of the load of data in visualization in order to get the results, eg:
Suppose you are filtering by:
"gsiReadCount: 1"
You can perform a filtered query to get better results:
message: "gsiReadCount: 1"
This will help in minimizing the search.