I have a saved search that when I run the search manually, I get the data I expect. When I run it as a saved search, it populates the displayed table as expected and then it all dissapears when the job is completed. (todays search returns about 4000 records.) When I inspect the job, the last stats and eval are highlighted yellow.
index="csradmin" sourcetype="SI_PROD" user="*" succ="succ" type="*"
(action="account_lookup" OR action="bind_device" OR action="reprov_device")
| eval completed=if(action=="account_lookup","Attempted","Completed")
| eval installer=case(
match(user,"tech*"), "Tech",
user="cust", "Customer",
0==0, "Netiher" )
| stats count(eval(completed="Attempted")) as com_at, count(eval(completed="Completed")) as com_cmp by act, installer, type
| eval com_at=max(com_at, com_cmp)
This is a common search that I need to further refine the data to build tables.
I have seen this behavior in the past, but it has been several months. In this case, I added a fields command to the end of the saved search, but it did not make a difference. Which I click on "Event List", instead of "Results Table", the expected logs are there.
Does anyone know why the table disappears and how to get it back?
