Event Search Returns no Results or Unexpected Results

Symptom:

An event search returns no results or unexpected results.

Solution:

Verify the following items:

Verify that you are using the correct properties and values that are listed in the Event Properties and Event Information section in the Administration Guide.
If you are using optional properties in search patterns, verify that the appropriate data sources produce that property.
Verify that the pattern syntax adheres to the conventions in the Event Search Syntax Guidelines and Best Practices section in the Administration Guide.
Try using the 'ANY event occurs' criterion first, because it does not consider time intervals. Once you have established that events exist that match the patterns, try a time-based pattern detection.
If you receive an error message before the results display that you need help interpreting, see the section on error messages.