I created a scheduled search that reads 2 input lookup csv files. It returns zero results when I look at the "View Recent"/Job Manager. When I run it by clicking the "Run" selection, I get the results that I'm looking for. What am I overlooking?
Answering my own question here - it needs to have dates to display results. In the end, I wrote the results to a summary index in a scheduled search using | collect index=test_summary addtime=true.
There are no timestamps in the lookup table. When I plug one in, I get the desired results.
Sorry, I have access to the files.
Which user does the scheduled search run as and do they have access to the lookup files?
It's under my username, with Admin privileges.