This search does not support your argument. Timechart is quantizing into buckets, representing a large enough set such that last() will be greater than the event at the end of the quantized bin. Events are processed in time reverse order, but because there may be tsidx fragments or multiple indexers there is no strict localized ( small scale) order without an order by function. this is exactly like the law of large numbers. Check out these links: http://wiki.splunk.com/Deploy:UnderstandingBuckets http://docs.splunk.com/Documentation/Splunk/6.0.1/Indexer/HowSplunkstoresindexes ... View more

The 10% was the fact that the regex in the default/transforms.conf was not right for the log events I was receiving - so when I added a local (transforms.conf) stanza for [sendmail-extractions] with a REGEX and FORMAT that matched the actual log events being received, it all started to work. ... View more