I have a report that is run daily going back 24 hours. That report was reporting results just fine up until a few days ago, and nothing about the report has changed, yet now the results in the email are blank even though running the search manually returns results. What could possibly cause this type of behavior? I have checked the schedule settings, permissions, the search itself, none of it is any different than what I originally saved. Other saved reports and alerts are running just fine.
Are there any sort of backend changes to splunk that have been known to cause this type of behavior? Perhaps changes in the environment?
There was a post about this same issue in 2015 titled "Scheduled report shows "No results found" but manual report sees data", which was never answered.
I was able to simply delete and resave the report, and it appears to be working properly now. I still would like to understand why this happens if anyone knows. Having a report/alert randomly break for reasons unknown is definitely unacceptable.