Not sure if it's the same exact thing but I have a similar issue. I'm trying to get a count of logs per day over 30 days. The first two applications in my query seem to be accurate but the second two applications are clearly not reporting back numbers. Should be hundreds or thousands of logs but it reports zero. After applying a filter to the same query looking for the specific application only, the numbers show the proper data.
At one point when I thought I was missing data, it's because one of the buckets was limiting on Size and the subbucket was splitting the data after it was already limited. In my case now, there is no such limitation as I am pulling a count of all data and only splitting on the keyword name of the application.
I think both of our issue may be related to some limitation on the amount of data it can query but I cannot find any such limitation that can be configured.