QUESTION

When ingesting logs into Panther, why does the number of events shown in Panther Search differ from what I see in the log source overview or when querying in Data Explorer?

ANSWER

Panther Search filters events using p_event_time representing when the event actually occurred. Data Explorer gives you full control over which timestamp field to filter on, allowing you to query by either p_event_time or p_parse_time (the time the event was ingested by Panther).

If your events carry older timestamps, for example, when ingesting historical logs those events may fall outside the time window Panther Search is displaying, even though they were recently ingested. This makes them appear "missing" in Search, while still being counted in the log source overview and accessible in Data Explorer.

To verify the number of ingested events regardless of event timestamp, you can adjust the time period in Search to start from the event that happened earlier or run the following query in Data Explorer:

SELECT COUNT(*)
FROM panther_logs.public.<your_schema_table>
WHERE p_source_id = '<your-source-id>' AND p_occurs_since('<insert the time period here>')