Reporting

Events not showing up using summary data

randy_moore
Path Finder

Hi,  I have a report that pulls daily transaction counts from a summary index.  Running the report for "month to date", I don't get results from every day.  
My search is this: 

 

index=summary search_name=Summarization_Daily_Txn App IN ("XXX")) endpoint="ZZZZ"
| bin _time span=1d
| stats sum(Count) AS Txn_Count  by _time
| addcoltotals

 

 
Gives me this output:

randy_moore_0-1638983522130.png

The Dec 2, 4th and 5th totals are missing.    Yes,  I have verified that there are counts for those days. 

If I run the report so that it spans just Dec 4th and 5th, the counts show up.   Just not if I run it using earliest=@mon latest=@d

Any ideas on what I am doing wrong?

Labels (1)
0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>