Hello, and I have another weird issue: When I execute a search on a SHC in the Search and Reporting App, getting data from 2025-02-27 index=test earliest=-7d@d latest=-6d@d I get zero events When I execute the search WITHOUT the earliest and latest time modifiers and use the Time Picker in the UI which results in "during Thu, Feb 27, 2025" I get around 167,153 results Specifying the time range with earliest and latest time modifiers is NOT giving me the "Your timerange was substituted based on your search string". If I use tstats, I get the correct number of events, the correct date, and the message "Your timerange was substituted based on your search string" is present | tstats count where index=test earliest=-7d@d latest=-6d@d by _time span=d I also made index=test earliest=-7d@d latest=-6d@d a saved search which executes every 10 minutes - zero events. Another bit of weirdness: If I run that search, and specify "All time", it will pull events ONLY for 2025-02-27. Nothing for other dates, and it has 12 months of events, populated for every day. So, it looks at both the time qualifiers and the time picker under that scenario. Any ideas what might be causing this? (I have several standalone searchheads that are working fine)
... View more