Splunk Search

Why does my search not return some of events older than 30 days?

moeini
Engager

Hi,

I have a very easy search to see how many events with field A have happened in each month.

index=X sourcetype=Y 
| dedup A date_month 
| stats  count(A) by date_month

When I use this search and set the time range to (2 months ago to 1 month ago), the values for that month are different from when I use it with (2 months ago to now). I checked the events and saw that Splunk does not detect some of the events that only occurred more than 30 days ago. Can anyone tell me where the problem is and How I can solve it?

Thanks!

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Can you try this search and see if the results are better

index=X sourcetype=Y | stats dc(A) as countA by date_month

AND

index=X sourcetype=Y | dedup date_month A  | stats  count(A) by date_month
0 Karma

MuS
SplunkTrust
SplunkTrust

Also check the job inspector to see what is going on with the search.

cheers, MuS

0 Karma

moeini
Engager

same results.
Thanks for mentioning the job inspector. Seems that it only can show up to 328 events (eventAvailableCount)

0 Karma

mosman_splunk
Splunk Employee
Splunk Employee

consult your authorize.conf and check the value assign to
srchTimeWin
srchMaxTime

probably it set to limit your results

0 Karma

moeini
Engager

Thanks for the help. I should check that with my administrator. Seems that I don't have access to this option.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...