Other Usage

Events not showing up using summary data

randy_moore
Path Finder

Hi,  I have a report that pulls daily transaction counts from a summary index.  Running the report for "month to date", I don't get results from every day.  
My search is this: 

 

index=summary search_name=Summarization_Daily_Txn App IN ("XXX")) endpoint="ZZZZ"
| bin _time span=1d
| stats sum(Count) AS Txn_Count  by _time
| addcoltotals

 

 
Gives me this output:

randy_moore_0-1638983522130.png

The Dec 2, 4th and 5th totals are missing.    Yes,  I have verified that there are counts for those days. 

If I run the report so that it spans just Dec 4th and 5th, the counts show up.   Just not if I run it using earliest=@mon latest=@d

Any ideas on what I am doing wrong?

Labels (1)
0 Karma
Get Updates on the Splunk Community!

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

New This Month - Observability Updates Give Extended Visibility and Improve User ...

This month is a collection of special news! From Magic Quadrant updates to AppDynamics integrations to ...

Intro to Splunk Synthetic Monitoring

In our last post, we mentioned that the 3 key pieces of observability – metrics, logs, and traces – provide ...