Why are notables not getting created?

[zacksoft_wf]

The correlation I am analyzing has some interesting issue.
1. When I run the SPL code separately in a search bar it has 100s of events, but when I see the Incident Review , I see only a few(very few).
2.. The last line of the correlation search  is  "outputlookup somelookup.csv".     But I see the creator of this lookup hasn't created it's definition. 
could this be the reason why the notables are not getting created ???? 
Also when I see the stats of the correlation it it shows 

Statistics

Avg. Event Count 0 Avg. Result Count 0 Avg. Run Time 0:00:00 Invocations 0 Skipped 0 Success 0

Could anyone confirm if my suspicion is correct that the missing definition of the lookup is prohibiting the notables from being created with no evidence of skips, errors, or suppression in the logs.

[woodcock · Accepted solution]

No, that is not it.  The problem is almost certainly that the value used for the timpicker does not consider the latency of the events until they become searchable in Splunk.  This latency is even larger if you are using accelerated datamodels.  You can calculate and examine the latency by doing "| eval latency = _index_time - _time".  This is why you almost always see timepicker values in good/working content that look like "earliest=@h-1h-15m latest=@-15m" instead of "earliest=-1h latest=now".