Hi zealvora, Your are not seeing that record could be because of records are merging. Are you using props.conf for this if not then you can try this. props.conf: [your sourcetype] BREAK_ONLY_BEFORE_DATE = true ... View more

If you turn this into a dashboard, you can use the charting.data.count option to set a higher limit (even unlimited (0) if you're feeling dangerous). http://docs.splunk.com/Documentation/Splunk/6.3.2/Viz/ChartConfigurationReference ... View more