Data from large search deleting during search. How do I override?

[gtspacegirl]

I have a user that is reporting that data is dropping out from a large search in splunk after a time. The user reported that the counter for IPcount was resetting for the most common event after time and restarted counting.

What should I be looking at to override when splunk drops out results.

Here is the query they were using...

sourcetype=web_access source=access | rex field=_raw "(?[0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3})" max_match=2| eval ip_1=mvindex(event, 0) | eval ip_2=mvindex(event, 1) | eval prefer_ip = if(match(ip_1,"^10.[0-9]") AND NOT match(ip_2,"^10.[0-9]"), ip_2, ip_1) | search SESSION_KEY!="'-'" AND SESSION_KEY!="':'" | stats distinct_count(prefer_ip) as IPcount, count by SESSION_KEY | stats count(IPcount) by IPcount

[appleman]

I guess it's better to create summary index first to make your data smaller (summarize your data a bit) and search it again.

collect index = [summary]