https://community.splunk.com/t5/Splunk-Search/I-am-running-an-import-script-for-an-interval-of-5-mins-to/m-p/488486#M193973 <P>Don't really understand the question. Can you please elaborate or provide an example? </P> Mon, 09 Mar 2020 10:41:55 GMT anmolpatel 2020-03-09T10:41:55Z https://community.splunk.com/t5/Splunk-Search/I-am-running-an-import-script-for-an-interval-of-5-mins-to/m-p/488485#M193972 <P>I have a situation where in the span of 10 mins there could be a possibility that we didn't get any data from one of the sourcetype for one interval but started getting data for next interval, by this way I am loosing data in summary index. Any suggestion would be helpful. </P> <P>Here's a part of my query:<BR /> | metadata type=sources index=abc <BR /> | search source=random <BR /> | eval earliest=lastTime - 300<BR /> | eval latest=now()<BR /> | fields earliest latest</P> <P>So this random source is collecting data from all the sourcetypes.</P> Fri, 06 Mar 2020 19:22:32 GMT https://community.splunk.com/t5/Splunk-Search/I-am-running-an-import-script-for-an-interval-of-5-mins-to/m-p/488485#M193972 Gunjan92 2020-03-06T19:22:32Z https://community.splunk.com/t5/Splunk-Search/I-am-running-an-import-script-for-an-interval-of-5-mins-to/m-p/488486#M193973 <P>Don't really understand the question. Can you please elaborate or provide an example? </P> Mon, 09 Mar 2020 10:41:55 GMT https://community.splunk.com/t5/Splunk-Search/I-am-running-an-import-script-for-an-interval-of-5-mins-to/m-p/488486#M193973 anmolpatel 2020-03-09T10:41:55Z https://community.splunk.com/t5/Splunk-Search/I-am-running-an-import-script-for-an-interval-of-5-mins-to/m-p/488487#M193974 <P>This is the reason that most searches of this type run at <EM>least</EM> 5 minutes back in time, preferably an hour or more. There really is no way around it. You can examine your latency with a search like this:</P> <PRE><CODE>|tstats max(_indextime) AS indextime WHERE index=_* OR index=* BY index sourcetype _time | stats avg(eval(indextime - _time)) AS latency BY index sourcetype | fieldformat latency = tostring(latency, "duration") | sort 0 - latency </CODE></PRE> Sun, 15 Mar 2020 21:39:27 GMT https://community.splunk.com/t5/Splunk-Search/I-am-running-an-import-script-for-an-interval-of-5-mins-to/m-p/488487#M193974 woodcock 2020-03-15T21:39:27Z