Network data statics dashboard

[Splunk_rocks]

Hello,

I have request to collect all network data based allowed denyed and dropped traffic info from various network feeds.
Unfortunately my network data model is not set only 15 days worth of data so i have to run manual searches to collect data so any
help will be much appreciated .
I have tried with below one but not showing all data and any help will be much appreciated

| tstats summariesonly=t allow_old_summaries=f count
 FROM datamodel=Network_Traffic.All_Traffic 
 WHERE index=* BY sourcetype All_Traffic.action _time span=1h 
 | rename All_Traffic.* AS * 
 | stats count As total_connections count(eval(action=="allowed")) AS allowed count(eval(action=="blocked" OR action=="dropped")) AS blocked BY _time, sourcetype 
 | eval pct_blocked = 100 * blocked / total_connections

[DalJeanis]

Certain things are a little unclear.

1) how much data do you want?
2) how much data is on the underlying indexes?
3) how much data is the data model set to retain?
4) have you verified that the data model is fully up to date and there are no skipped searches?