For monitoring purposes I have a columnchart showing the number of events per minute for the last 30 minutes ("30 minute window"). I've noticed several times that the columnchart doesn't show the correct number of events, even when missing events show up in the search query used to create the columnchart. This is the query I use;
index="prod" application="wsp2" source="/var/log/httpd/access_log" | timechart count
