There could be a number of reasons why a report generated by the "scheduler" (alerts) vs. a dashboard, but the most common are related to permissions and timestamping. If timestamps (_time) in your data are being extracted incorrectly, or with great enough drift you could see discrepencies between scheduled and dashboard based searches.
Without having some specifics around your configurations this is a bit tricky to answer. There is also some weirdness related to why this works part of the month, but not in the middle.... I would recommend opening a case with support if this is still an issue for you.