Hi,
I have a very easy search to see how many events with field A have happened in each month.
index=X sourcetype=Y
| dedup A date_month
| stats count(A) by date_month
When I use this search and set the time range to (2 months ago to 1 month ago), the values for that month are different from when I use it with (2 months ago to now). I checked the events and saw that Splunk does not detect some of the events that only occurred more than 30 days ago. Can anyone tell me where the problem is and How I can solve it?
Thanks!
Can you try this search and see if the results are better
index=X sourcetype=Y | stats dc(A) as countA by date_month
AND
index=X sourcetype=Y | dedup date_month A | stats count(A) by date_month
Also check the job inspector to see what is going on with the search.
cheers, MuS
same results.
Thanks for mentioning the job inspector. Seems that it only can show up to 328 events (eventAvailableCount)
consult your authorize.conf and check the value assign to
srchTimeWin
srchMaxTime
probably it set to limit your results
Thanks for the help. I should check that with my administrator. Seems that I don't have access to this option.