Hello
i'm running this query :
index=prod sourcetype=nim tail_id="*N8*" | transaction startswith="*---- BEGIN IPTABLES ON IO CORE ----*" endswith="*---- END IPTABLES ON COMM CORE ----*" maxevents=1100
while running the query for 11 days everything working as expected.
while running for more than 11 days i see gaps in the data
any ideas why ?
thanks