GRAYLOG - Chapter 1, Exercise 2 Solution
==========================================================
Zero Results Despite a Correct Query

PROBLEM
-------
A colleague runs the query service:scout AND level:(2 OR 3) and gets
zero results, even though they're confident scout has thrown critical
or error-level messages recently. Using this chapter's own material,
name the most likely explanation that has nothing to do with the query
text itself.

SOLUTION
--------
The query itself is syntactically correct per this chapter's own
material - service:scout AND level:(2 OR 3) properly uses field:value
syntax, AND, and the field:(X OR Y) grouping shorthand. Since the query
text isn't the problem, the chapter's own real, separate gotcha applies:
the time range is set via Graylog's own UI picker, entirely outside the
query string.

If the time-range picker is currently scoped to a window that doesn't
actually include when those critical/error messages happened - for
example, it's set to "last 5 minutes" but the errors occurred an hour
ago - the query will correctly return zero results for THAT window,
even though matching messages genuinely exist elsewhere in Graylog's
own stored data.

ANSWER: The most likely explanation unrelated to the query text itself
is that the time-range picker in the UI is scoped to a window that
doesn't cover when the actual critical/error messages occurred. Widening
or repositioning the time range, not editing the query, is the fix to
check first.

----
WHY THIS WORKS AS AN ANSWER

This directly applies the chapter's own explicit warning that a
"perfectly correct query can return zero results simply because the
picker is scoped to the wrong window." Since the query syntax here has
no real errors, the time range is the single most likely remaining
explanation this chapter has already covered - a genuinely common,
easy-to-overlook mistake precisely because it lives outside the text you
were actually looking at.