Why does job manager shows 0 events, but job link shows results?

[donutgalileo]

Hi,  I have set up a scheduled report that runs every hour and writes the result set to a csv file. Activity->Jobs shows that the report was run per schedule, but I don't see the expected result in the output csv. The job manager shows the search returned 0 events, but when I open the job link, I see more than 6000 results in the table. Why do the events in the show up as 0 in the job manager?

 

[bowesmana]

You are not searching 'events' as such from an index, so the event count is 0. 

As to why you are not seeing the expected results in the events.csv after the search - what appears wrong?

From what I can make out, that events.csv is used as input and output, so unless that csv is being updated elsewhere, the time() - epochTIme will eventually be > 3600 seconds, so all rows will eventually disappear from the csv.

[donutgalileo]

I need to retain events from last 24 hours in event.csv. I have a scheduled report running every 5 minutes that gets events from the last 5 minutes and appends to events.csv. I don't want this to be unbounded, so I set up another scheduled report that runs every once a day (60 minutes in this case for testing) that limits the data set from the csv and replaces the content in the csv. The first job runs fine, appends results every 5 minutes, the second job appears to run but does not have the intended effect. A timechart from the csv shows data for several hours.

[bowesmana]

OK, got it - can you share a redacted example of the events.csv after that search has run, where it includes incorrect information