Simple Log Service:Inaccurate results in the console

When you query and analyze logs, the Simple Log Service console may display the message The results are inaccurate. This message indicates that Simple Log Service did not scan all logs, so the returned query results are incomplete. For example, on the Query and Analysis page of the nginx-log logstore, you run the SQL statement select http_referer, count(1) pv group by http_referer order by pv desc. The logstore contains approximately 100 billion (100,006,376,644) log entries, and the query results display a red warning: The results are inaccurate.

This issue is typically caused by one of the following.

• The query time range is too large

  If you set a long query time range, such as three months or one year, Simple Log Service cannot scan all logs within that period in a single query. To return results quickly, the service returns partial and inaccurate results.

• The search conditions are too complex

  For example, if you specify 30 search conditions in a single query statement, Simple Log Service cannot retrieve all matching logs at once.

• The data volume for SQL computation is too large

  If your analytic statement includes multiple fields and the corresponding data volume is large, that volume may exceed the read capacity of a shard. Each shard can read up to 1 GB of data. If this limit is exceeded, the service returns inaccurate results.