EDR: Why does the 3 day search not return events?

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

Why does the 3 day search not return events but those events are seen with the 1 week search?

Environment

• EDR (formerly Response) Server: 6.x and above

Resolution

Design logic for optimizing searches can cause unexpected results when sensors are offline for a long time or backlog is large

Additional Information

• Process searches use time ranges to narrow down the cores that are searched to help optimize search returns. This is done by the last_server_update field internally. last_update from the endpoint and last_server_update do not have to be the same but can lead to the discrepancy   seen with the time range searches. 
• Searching All Time would not be prone to this, however should be used in rare cases