Why is stats count by sourcetype missing some sourcetypes?

[dilpreetsingh]

index=app_xxxxxxxxx_products cluster_name=dxx-exx-awslab sourcetype=xxxxxxx:deployment-info | stats count by sourcetype

Returns count for the sourcetype but when ran as :

index=app_xxxxxxxxx_products cluster_name=dxx-exx-awslab  | stats count by sourcetype

The results don't include the sourcetype mentioned in firsts search.

[gcusello]

Hi dilpreetsingh,
do events with sourcetype=xxxxxxx:deployment-info continously arrive or not?
did you used the same time period (e.g. earliest=-2h@h latest=-h@h)? don't use latest=now.

Bye.
Giuseppe