This topic describes common issues and how to troubleshoot them

Gaps in metric data

If a metric gap occurs, you will receive the following error message:

<code>Metric gaps exist during the time selected, which means that you may experience inaccurate reporting for the data. To learn more about what can cause metric gaps, see the documentation.</code>

A metrics gap can occur for multiple reasons:

Summary metrics are generated by saved searches. These searches can sometimes fail, for example, if the search head is unavailable. If searches fail, Ingest monitoring is unable to summarize the affected events and write them to the metrics index, potentially resulting in a temporary gap in the summary. When a saved search fails, Splunk tracks the failure and automatically attempts to rerun the search at a later time to restore the metrics.

You may have paused Ingest monitoring, ingestion that occurred while Ingest monitoring is paused is not available for queries in the Ingest monitoring app.

Metrics gaps can occur when you are searching outside the time range for available data, for example, if you are searching during a period of time that occurred before you turned on Ingest monitoring.