https://community.splunk.com/t5/Splunk-Search/Why-does-my-search-not-return-some-of-events-older-than-30-days/m-p/244980#M72996 <P>same results. <BR /> Thanks for mentioning the job inspector. Seems that it only can show up to 328 events (eventAvailableCount)</P> Tue, 10 May 2016 23:48:52 GMT moeini 2016-05-10T23:48:52Z https://community.splunk.com/t5/Splunk-Search/Why-does-my-search-not-return-some-of-events-older-than-30-days/m-p/244976#M72992 <P>Hi, </P> <P>I have a very easy search to see how many events with field A have happened in each month.</P> <PRE><CODE>index=X sourcetype=Y | dedup A date_month | stats count(A) by date_month </CODE></PRE> <P>When I use this search and set the time range to (2 months ago to 1 month ago), the values for that month are different from when I use it with (2 months ago to now). I checked the events and saw that Splunk does not detect some of the events that only occurred more than 30 days ago. Can anyone tell me where the problem is and How I can solve it? </P> <P>Thanks!</P> Tue, 10 May 2016 18:40:42 GMT https://community.splunk.com/t5/Splunk-Search/Why-does-my-search-not-return-some-of-events-older-than-30-days/m-p/244976#M72992 moeini 2016-05-10T18:40:42Z https://community.splunk.com/t5/Splunk-Search/Why-does-my-search-not-return-some-of-events-older-than-30-days/m-p/244977#M72993 <P>consult your authorize.conf and check the value assign to <BR /> srchTimeWin<BR /> srchMaxTime</P> <P>probably it set to limit your results</P> Tue, 10 May 2016 19:07:19 GMT https://community.splunk.com/t5/Splunk-Search/Why-does-my-search-not-return-some-of-events-older-than-30-days/m-p/244977#M72993 mosman_splunk 2016-05-10T19:07:19Z https://community.splunk.com/t5/Splunk-Search/Why-does-my-search-not-return-some-of-events-older-than-30-days/m-p/244978#M72994 <P>Can you try this search and see if the results are better</P> <PRE><CODE>index=X sourcetype=Y | stats dc(A) as countA by date_month </CODE></PRE> <P>AND </P> <PRE><CODE>index=X sourcetype=Y | dedup date_month A | stats count(A) by date_month </CODE></PRE> Tue, 10 May 2016 20:45:02 GMT https://community.splunk.com/t5/Splunk-Search/Why-does-my-search-not-return-some-of-events-older-than-30-days/m-p/244978#M72994 somesoni2 2016-05-10T20:45:02Z https://community.splunk.com/t5/Splunk-Search/Why-does-my-search-not-return-some-of-events-older-than-30-days/m-p/244979#M72995 <P>Also check the job inspector to see what is going on with the search.</P> <P>cheers, MuS</P> Tue, 10 May 2016 21:16:17 GMT https://community.splunk.com/t5/Splunk-Search/Why-does-my-search-not-return-some-of-events-older-than-30-days/m-p/244979#M72995 MuS 2016-05-10T21:16:17Z https://community.splunk.com/t5/Splunk-Search/Why-does-my-search-not-return-some-of-events-older-than-30-days/m-p/244980#M72996 <P>same results. <BR /> Thanks for mentioning the job inspector. Seems that it only can show up to 328 events (eventAvailableCount)</P> Tue, 10 May 2016 23:48:52 GMT https://community.splunk.com/t5/Splunk-Search/Why-does-my-search-not-return-some-of-events-older-than-30-days/m-p/244980#M72996 moeini 2016-05-10T23:48:52Z https://community.splunk.com/t5/Splunk-Search/Why-does-my-search-not-return-some-of-events-older-than-30-days/m-p/244981#M72997 <P>Thanks for the help. I should check that with my administrator. Seems that I don't have access to this option. </P> Tue, 10 May 2016 23:49:25 GMT https://community.splunk.com/t5/Splunk-Search/Why-does-my-search-not-return-some-of-events-older-than-30-days/m-p/244981#M72997 moeini 2016-05-10T23:49:25Z