The upload can succeed and the Events table can still say No stored events in this window. That usually means the 24h, 7d, or 30d control is on, and the events in the file happened earlier than that window.
Those controls use each event’s own timestamp (when the log says it occurred). They do not use when you uploaded the file. A Windows, syslog, or SOC export from last year is stored tonight, but it will not appear under 24h.
The page often opens on 7d. That range is empty for the same reason as 24h.
1. Open Historical Metadata.
2. Click All.
3. Confirm the rows: type, Asset, channel file_upload, and Keep until.
Event volume uses the same window. If 24h / 7d / 30d show no rollup data, All plots the older timestamps.
The Historical series chart below the table is separate. 24h / 7d / 30d / All do not filter that chart. A series can have Work-Input / Work-Output even when the Events table is empty for the selected window.
Kept Mode 2 rows stay visible until Keep until (the retention you chose on upload). After that they drop off All as well. Mapped series values that already wrote stay.
If All is also empty, the file was not stored as raw events (Keep-for of 0 hours and 0 seconds), the Keep-for window already ended, or the events were discarded on parse. Then walk the import checklist: format, enabled mapping, ingest meter, trial.
Still stuck? Email [email protected] with the Mode (1/2/3), approximate time (UTC), and Asset id — not raw log bodies.