If the Log Service Console prompts that the query results are inaccurate when you retrieve the analysis logs, refer to this document for troubleshooting.

Problem description

When you retrieve analysis logs, if the Log Service console prompts that the query results are not accurate , the Log Service fails to scan all logs, and the retrieval and analysis results returned are not accurate based on all logs.

Possible reason

Possible reasons for inaccurate query results are as follows:

The set retrieval time range is too large (for example, a retrieval time range of 3 months), and the log service cannot scan all logs for that time period in a single retrieval. To return results quickly, return partially inaccurate results first.

The set of search conditions is too complex (e.g. 30 search conditions are set simultaneously), and the logging service cannot read all the search results at once.

The amount of data calculated by SQL is too large. If you set multiple fields in a single SQL statement, and the amount of data in these fields exceeds the reading capacity of the shard (each shard can only read 1 gigabyte of data), the returned results are inaccurate.

Solution

Perform corresponding operations according to possible reasons, such as narrowing the search time range, simplifying the search analysis statement, and executing the search analysis statement multiple times (within 10 times).

Last updated: 2026.06.25 17:01:03

Public security network record in Beijing: No. 11010802032137