on 5.7, why is it when I clone a filter, it works but when I create the exact same filter it fails?

I'm new to LEM, but I was trying to create a filter and it was not populating.

I figured I had a logic error, so I started from scratch with a basic security alerts filter. Still nothing. Then I cloned the security alerts and it works.

I remove the condition and add it back in and it stops???

I also noticed I can't put further conditions in that original group. But if I delete it, I can add to it. but still doesn't work.

Any ideas?