I stumbled across something odd today when searching for events in the ArcSight Command Center (ESM 6.5cSP1)
When I search for CISCO events, the preview function sees there are 145,780 events.
And you can see 145,780 events from an Active Channel in the console
But when you click "Go" to execute the search, it returns no results
Rebooting the ESM server did not fix the issue.