I have a user that is reporting that data is dropping out from a large search in splunk after a time. The user reported that the counter for IPcount was resetting for the most common event after time and restarted counting.
What should I be looking at to override when splunk drops out results.
Here is the query they were using...
sourcetype=web_access source=access | rex field=_raw "(? [0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3})" max_match=2| eval ip_1=mvindex(event, 0) | eval ip_2=mvindex(event, 1) | eval prefer_ip = if(match(ip_1,"^10.[0-9]") AND NOT match(ip_2,"^10.[0-9]"), ip_2, ip_1) | search SESSION_KEY!="'-'" AND SESSION_KEY!="':'" | stats distinct_count(prefer_ip) as IPcount, count by SESSION_KEY | stats count(IPcount) by IPcount
... View more