Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

Why does my search not return some of events older than 30 days?

$
0
0
Hi, I have a very easy search to see how many events with field A have happened in each month. index=X sourcetype=Y | dedup A date_month | stats count(A) by date_month When I use this search and set the time range to (2 months ago to 1 month ago), the values for that month are different from when I use it with (2 months ago to now). I checked the events and saw that Splunk does not detect some of the events that only occurred more than 30 days ago. Can anyone tell me where the problem is and How I can solve it? Thanks!

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>