Hi, I have a few questions regarding Summary Indexing behavior in Splunk. The source search returns 311 events, whereas the summary index contains count=9. Could you please explain why the value stored in the summary index differs from the source search results? Under what circumstances can this occur? Is there any specification or built-in behavior in Summary Indexing whereby duplicate events are removed or aggregated when a large number of identical messages are generated from the same host? If this behavior is not caused by the Summary Indexing mechanism itself, what other factors could result in this discrepancy between the source search results and the summary index values? For example, could it be related to indexing latency, scheduled search execution timing, searchable event availability, or differences in the search time range? Any clarification on how Summary Indexing processes and stores search results would be greatly appreciated. Thank you. ... View more