It's likely that the events you're referring to as missed, were not actually present in the index at the time the search was run. The only reason Splunk wouldn't pick them up, is if they weren't actually there.
You can verify this with the following - <your_search_terms> | convert ctime(_indextime) as IT - and the IT field will tell you when the events were actually written to the index. When you're indexing a high volume of data, or from a lot of different sources, there can be a bit of a lag between an event being produced and Splunk actually writing it to the index.
To account for this, many Customers simply offset their searches a bit, so for 'last minute search' you could start the search 2 or even 3 minutes back and end it 1 or 2 minutes later. For example -
<your_search_terms> startminutesago=3 endminutesago=2
You're still searching over a span of 1 minute, and running every minute means you'll still cover all possible time-ranges, but you're allowing for the lag of getting data into the index.
... View more
