Hello

Using 7.4.1.0_2512.

I have a simple report based on the ISO 27002 11.5.1 Use Login
Activities report with the following query:

(xdasreg:0 AND xdasprov:0 AND xdasoutcome:[0 TO 2]) AND ((xdasclass:2
AND (xdasid:0 OR xdasid:4 OR xdasid:5)) AND rv32:OS) AND (evt:"sshd\:
User authenticated")

If I run the report by clicking "Search events" and I select the date
range 2016 Apr 17 00:00:00 to 2016 Apr 24 11:59:59 I get two events.

If I select "Run" on the report and select previous week that gives me
exactly those dates I get an empty report.

If I select "Run" and select "Month to date" I get a bunch of events and
even those two that happened the previous week that were missing from
the previous week report.

The query in the log when I use previous week is:

Fri Apr 29 14:16:08 CEST 2016|INFO|ReportProcessResponseReaderThread:
Report
1|com.novell.reports.jasper.data.AutoDetectingData Provider.setFullReportQueryString
Full Report Query is: SELECT
dt AS event_parse_time,
evt AS event_name,
pn AS product_name,
sp AS initservicename,
dp AS targetservicename,
sun AS initusername, iuid AS inituserid, iufname AS
inituserfullname, rv35 AS inituserdomain, iudep AS inituserdepartment,
iwfid AS inituserworkforceid, iudep AS inituserdepartment, iemail AS
inituseremail,
dun AS targetusername, tuid AS targetuserid, tufname AS
targetuserfullname, rv45 AS targetuserdomain, tudep AS
targetuserdepartment, twfid AS targetuserworkforceid, temail AS
targetuseremail,ttn AS targetusertrustname, ttid AS targetusertrustid,
shn AS inithostname, rv42 AS inithostdomain, sip AS
init_ip, rv76 AS inithostdepartment,
dhn AS targethostname, rv41 AS targethostdomain, dip AS
target_ip, rv98 AS targethostdepartment, dmac AS targetMAC,
xdasoutcome AS xdasoutcome,xdasoutcomename AS
xdasoutcomename,xdasreg AS xdasreg,xdasprov AS xdasprov,xdasclass AS
xdasclass,xdasid AS xdasid,xdasdetail AS xdasdetail,
SetIfNull(dhn|zzzzzzzzzz) AS
group_by_sortable1,SetIfNull(dip|zzzzzzzzzz) AS
group_by_sortable2,SetIfNull(rv41|zzzzzzzzzz) AS
group_by_sortable3,SetIfNull(rv98|zzzzzzzzzz) AS group_by_sortable4
WHERE
(xdasreg:0 AND xdasprov:0 AND xdasoutcome:[0 TO 2]) AND
((xdasclass:2 AND (xdasid:0 OR xdasid:4 OR xdasid:5)) AND rv32:OS) AND
(evt:"sshd\: User authenticated") OVER 2016-04-17 00:00:00, 2016-04-24
23:59:59 MAXCOUNT=1000


When I use month to date:



Fri Apr 29 14:18:36 CEST 2016|INFO|ReportProcessResponseReaderThread:
Report
2|com.novell.reports.jasper.data.AutoDetectingData Provider.setFullReportQueryString
Full Report Query is: SELECT
dt AS event_parse_time,
evt AS event_name,
pn AS product_name,
sp AS initservicename,
dp AS targetservicename,
sun AS initusername, iuid AS inituserid, iufname AS
inituserfullname, rv35 AS inituserdomain, iudep AS inituserdepartment,
iwfid AS inituserworkforceid, iudep AS inituserdepartment, iemail AS
inituseremail,
dun AS targetusername, tuid AS targetuserid, tufname AS
targetuserfullname, rv45 AS targetuserdomain, tudep AS
targetuserdepartment, twfid AS targetuserworkforceid, temail AS
targetuseremail,ttn AS targetusertrustname, ttid AS targetusertrustid,
shn AS inithostname, rv42 AS inithostdomain, sip AS
init_ip, rv76 AS inithostdepartment,
dhn AS targethostname, rv41 AS targethostdomain, dip AS
target_ip, rv98 AS targethostdepartment, dmac AS targetMAC,
xdasoutcome AS xdasoutcome,xdasoutcomename AS
xdasoutcomename,xdasreg AS xdasreg,xdasprov AS xdasprov,xdasclass AS
xdasclass,xdasid AS xdasid,xdasdetail AS xdasdetail,
SetIfNull(dhn|zzzzzzzzzz) AS
group_by_sortable1,SetIfNull(dip|zzzzzzzzzz) AS
group_by_sortable2,SetIfNull(rv41|zzzzzzzzzz) AS
group_by_sortable3,SetIfNull(rv98|zzzzzzzzzz) AS group_by_sortable4
WHERE
(xdasreg:0 AND xdasprov:0 AND xdasoutcome:[0 TO 2]) AND
((xdasclass:2 AND (xdasid:0 OR xdasid:4 OR xdasid:5)) AND rv32:OS) AND
(evt:"sshd\: User authenticated") OVER 2016-04-01 00:00:00, 2016-04-29
14:18:36 MAXCOUNT=1000


What am I doing wrong? Why won't my previous week report produce any
events? I would like to schedule the report to run every Monday with the
events from the previous week, that's why I'm asking.