transaction returns gaps

sarit_s — Mon, 04 Jan 2021 09:58:47 GMT

Hello

i'm running this query :

index=prod sourcetype=nim tail_id="*N8*" | transaction startswith="*---- BEGIN IPTABLES ON IO CORE ----*" endswith="*---- END IPTABLES ON COMM CORE ----*" maxevents=1100

while running the query for 11 days everything working as expected.
while running for more than 11 days i see gaps in the data

any ideas why ?

thanks

topic transaction returns gaps in Splunk Dev

transaction returns gaps