Datamodel tstats search and normal search result is not same

[burakatabay]

Hi,

I run two splunk search and results not come same.

In the first search is with tstats ;

timeprefix = yesterday

| tstats `summariesonly` count from datamodel=Authentication.Authentication where index=wineventlog Authentication.user=some_user

result is = 8990

In the second search ;

index=wineventlog  user=some_user tag=authentication NOT (action=success user=*$)| stats count

result is = 9000

Why datamodel and normal splunk search result is different ? 

Also ;

Datamodel accelaration status is %99 ? 

Could the problem be caused by this?

Thank you.

[richgalloway]

The summariesonly option tells tstats to look only at events that are in the accelerated datamodel.  If the DMA is not complete then the results also will not be complete.

[burakatabay]

My DMA is never been %100. it's generally %99.x . Why is this happening ? 

How ı find the problem ?