Missing part of log files in Splunk

[VictorHK]

We setup Splunk to monitor log files and generate alerts on abnormal situations. Log files are recording all activities done from open up of Excel reports, processing, file save and close. There are more than 500 Excel files to be handled daily.

Recently, false alarm were triggered. After investigation, we found not all transaction lines in the log files can be found from Splunk. Sometime, a few lines from the beginning of one or two log files will not show in Splunk. And sometime, a few lines at the end of the log files will not show.

Can Splunk or super users here can give advice or even solution ?

[sideview]

I think you'll have to post more details, definitely including the transaction command that you're using. I'm sure you've already closely examined the arguments to transaction very closely for errors.

However sometimes when there are multiple arguments to transaction (startswith plus maxspan plus endswith to take an example), the precedence rules for resolving ambiguities can be unintuitive.