How to troubleshoot why pivot finalizes before end of search and results are incomplete?d

[rsawant]

We have created a data model and we use this to create pivots. Since yesterday, we observed that the results of the pivots are incomplete. When we open the pivot in search (or use pivot command and run a search in the same data model), we get all the relevant results.

There are no errors in the internal logs. Any idea why this might be occurring? Please help!!

[jonnim]

I have the same problem ... I did a search using the top level of the datamodel (eventtype=xxx) for a unique time range 24th of February. I did the same search eventtype=xxx using SPL for the same time range and I got more results in the SPL query thanm the Pivot query. Incidentally I ran a datamodel query and that seems to work so I don't think its a datamodel issue.

[stephanefotso]

Hello! Did you check the timerange filter in the pivot ?

[rsawant]

Yes. The events in the data model ranges from Jan 2015 till now. Whatever time range I pick, (previous month, yesterday, today, a specific date), the results are incomplete.
Also, when I select all time, and check out the count of events over time in the pivot visualisation, the event count doesn't seem to be populating from latest to earliest. The time chart populates count in random order of date as the search progresses. Is this indicative of something?