<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Events not showing up using summary data in Other Usage</title>
    <link>https://community.splunk.com/t5/Other-Usage/Events-not-showing-up-using-summary-data/m-p/577796#M1325</link>
    <description>&lt;P&gt;Hi,&amp;nbsp; I have a report that pulls daily transaction counts from a summary index.&amp;nbsp; Running the report for "month to date", I don't get results from every day.&amp;nbsp;&amp;nbsp;&lt;BR /&gt;My search is this:&amp;nbsp;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;LI-CODE lang="java"&gt;index=summary search_name=Summarization_Daily_Txn App IN ("XXX")) endpoint="ZZZZ"
| bin _time span=1d
| stats sum(Count) AS Txn_Count  by _time
| addcoltotals&lt;/LI-CODE&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;BR /&gt;Gives me this output:&lt;/P&gt;&lt;P&gt;&lt;span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="randy_moore_0-1638983522130.png" style="width: 400px;"&gt;&lt;img src="https://community.splunk.com/t5/image/serverpage/image-id/17153iD635B6F85E0BC205/image-size/medium?v=v2&amp;amp;px=400" role="button" title="randy_moore_0-1638983522130.png" alt="randy_moore_0-1638983522130.png" /&gt;&lt;span class="lia-inline-image-caption" onclick="event.preventDefault();"&gt;randy_moore_0-1638983522130.png&lt;/span&gt;&lt;/span&gt;&lt;/P&gt;&lt;P&gt;The Dec 2, 4th and 5th totals are missing.&amp;nbsp; &amp;nbsp; Yes,&amp;nbsp; I have verified that there are counts for those days.&amp;nbsp;&lt;BR /&gt;&lt;BR /&gt;If I run the report so that it spans just Dec 4th and 5th, the counts show up.&amp;nbsp; &amp;nbsp;Just not if I run it using earliest=@mon latest=@d&lt;BR /&gt;&lt;BR /&gt;Any ideas on what I am doing wrong?&lt;/P&gt;</description>
    <pubDate>Wed, 08 Dec 2021 17:20:47 GMT</pubDate>
    <dc:creator>randy_moore</dc:creator>
    <dc:date>2021-12-08T17:20:47Z</dc:date>
    <item>
      <title>Events not showing up using summary data</title>
      <link>https://community.splunk.com/t5/Other-Usage/Events-not-showing-up-using-summary-data/m-p/577796#M1325</link>
      <description>&lt;P&gt;Hi,&amp;nbsp; I have a report that pulls daily transaction counts from a summary index.&amp;nbsp; Running the report for "month to date", I don't get results from every day.&amp;nbsp;&amp;nbsp;&lt;BR /&gt;My search is this:&amp;nbsp;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;LI-CODE lang="java"&gt;index=summary search_name=Summarization_Daily_Txn App IN ("XXX")) endpoint="ZZZZ"
| bin _time span=1d
| stats sum(Count) AS Txn_Count  by _time
| addcoltotals&lt;/LI-CODE&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;BR /&gt;Gives me this output:&lt;/P&gt;&lt;P&gt;&lt;span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="randy_moore_0-1638983522130.png" style="width: 400px;"&gt;&lt;img src="https://community.splunk.com/t5/image/serverpage/image-id/17153iD635B6F85E0BC205/image-size/medium?v=v2&amp;amp;px=400" role="button" title="randy_moore_0-1638983522130.png" alt="randy_moore_0-1638983522130.png" /&gt;&lt;span class="lia-inline-image-caption" onclick="event.preventDefault();"&gt;randy_moore_0-1638983522130.png&lt;/span&gt;&lt;/span&gt;&lt;/P&gt;&lt;P&gt;The Dec 2, 4th and 5th totals are missing.&amp;nbsp; &amp;nbsp; Yes,&amp;nbsp; I have verified that there are counts for those days.&amp;nbsp;&lt;BR /&gt;&lt;BR /&gt;If I run the report so that it spans just Dec 4th and 5th, the counts show up.&amp;nbsp; &amp;nbsp;Just not if I run it using earliest=@mon latest=@d&lt;BR /&gt;&lt;BR /&gt;Any ideas on what I am doing wrong?&lt;/P&gt;</description>
      <pubDate>Wed, 08 Dec 2021 17:20:47 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Other-Usage/Events-not-showing-up-using-summary-data/m-p/577796#M1325</guid>
      <dc:creator>randy_moore</dc:creator>
      <dc:date>2021-12-08T17:20:47Z</dc:date>
    </item>
  </channel>
</rss>

