I have a search that is returning 27 events within a 10 minute window. If I increase the window to 40 minutes, pulling in 30 minutes before the original timezone, I get 54 events, but some of the original events have gone missing.
This is the search:
ns="article.load" | where geoCity=="LONDON" | transaction txid maxspan=30m maxpause=30m | eventstats perc95(duration) as perc | where duration < perc
The UI doesn't seem to suggest I'm hitting any limits and the numbers of events are very low.
Why might this be happening?
Thanks, Tom
... View more