When I use the same search string without date_mday, the Windows sources show up as I'd expect.
The only other detail is that I'm limiting my search to a specific splunk server to limit the scope of my search:
splunk_server="SERVERNAME" | stats count by host, source, date_mday
I did set a date restriction (2012-02-01 00:00:00 to now). I'm not aware of any other input I might be excluding, as this is all I'm specifying in splunk.
... View more