A warning icon next to a dashboard widget or on the Interactive Analytics page indicates that there might be a problem with the data being displayed.
The problem can occur when vRealize Log Insight must process a very large number of log events to provide an accurate result. Sometimes a small portion of collected logs is not processed, and not included in the final results. Depending on the vRealize Log Insight load at the moment and the quantity of logs it must process for the query, the number of logs that are processed and the query result can vary.
Queries that contain a group-by clause, cover a significant number of logs, or return a relatively large number of results might display this behavior.
You can address this issue by substituting a query that produces time series results instead of a single value. This type of query produces more accurate results because query processing is not affected by log volume.