Other Usage

Events not showing up using summary data

randy_moore
Path Finder

Hi,  I have a report that pulls daily transaction counts from a summary index.  Running the report for "month to date", I don't get results from every day.  
My search is this: 

 

index=summary search_name=Summarization_Daily_Txn App IN ("XXX")) endpoint="ZZZZ"
| bin _time span=1d
| stats sum(Count) AS Txn_Count  by _time
| addcoltotals

 

 
Gives me this output:

randy_moore_0-1638983522130.png

The Dec 2, 4th and 5th totals are missing.    Yes,  I have verified that there are counts for those days. 

If I run the report so that it spans just Dec 4th and 5th, the counts show up.   Just not if I run it using earliest=@mon latest=@d

Any ideas on what I am doing wrong?

Labels (1)
0 Karma
Get Updates on the Splunk Community!

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...