In your search parameters you might specify a timerange from which you want your results. That's ok. But an index itself has some limits as to for how long it holds events and how much data it can hold. If the events get too old or if you have too many of them, oldest events will get removed from the index.
You can check from what period and how many events you have by using this search:
| dbinspect where index=idx_common_6mon
| stats min(startEpoch) as earliest max(endEpoch) as latest sum(eventCount) as count sum(rawSize) as size by index splunk_server
| fieldformat earliest=strftime(earliest,"%c")
| fieldformat latest=strftime(latest,"%c")
| eval size=round(size/(1024*1024))
If you want to check your index parameters, check the settings menu->indexes or run
| rest /services/data/indexes
| search title=idx_common_6mon
| fields title frozenTimePeriodInSecs maxDataSize
| stats values(frozenTimePeriodInSecs) as retention values(maxDataSize) as sizelimit by title
| eval retention=round(retention/86400)
