Hello, I have a search and when I run it, it returns 514.299 events:
To speed up load times I have saved and scheduled that search, maintaining the same time range and extending the dispatch.max_count parameter in savedsearches.conf to 600.000 to ensure that no data is lost.
When I inspect the scheduled saved search execution, however, I notice that it doesn't return all of the results, even though it scans them:
This discrepancy can be as many as 30.000 results: it's never the same amount after every scheduled execution, and it never matches the results returned if I run the search independently..
Any ideas as to why this is happening? Any parameters I can check?