https://community.splunk.com/t5/Splunk-Search/Why-does-my-search-not-finish/m-p/348510#M103158 <P>If you specified to search with a "2 month <A href="http://docs.splunk.com/Splexicon:Timerangewindow">window</A>" that means you setup a <A href="http://docs.splunk.com/Splexicon:Realtimesearch">real-time search</A>, which is a continuously executing search.</P> <P>Instead you want to run a normal historic search (using the "Relative" section of the time range picker) to which the picker would instead read "Last 2 months"</P> Mon, 29 Jan 2018 21:37:56 GMT acharlieh 2018-01-29T21:37:56Z https://community.splunk.com/t5/Splunk-Search/Why-does-my-search-not-finish/m-p/348508#M103156 <P><CODE>index="king" source ="/King/East"</CODE></P> <P>I am confused why my search doesn't finish. I have a '2 month window' applied to the time.</P> <P>When I inspect the job I see: <STRONG>This search is still running and is approximately 100% complete.</STRONG></P> <P>In the log, the following two items keep repeating every ~5s:</P> <PRE><CODE>01-29-2018 21:14:25.205 INFO SortOperator - maxmem = 209715200 01-29-2018 21:14:25.337 INFO DispatchThread - Generating results preview took 157 ms </CODE></PRE> <H2>When I remove the time filter, and allow for 'All time', the search completes with the output: <CODE>This search has completed and has returned 16,484 results by scanning 44,750 events in 1.944 seconds</CODE></H2> <P>The search that gets stuck:</P> <P><span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/4273i72CF90A8C8A561B8/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> Mon, 29 Jan 2018 21:25:56 GMT https://community.splunk.com/t5/Splunk-Search/Why-does-my-search-not-finish/m-p/348508#M103156 fraser8 2018-01-29T21:25:56Z https://community.splunk.com/t5/Splunk-Search/Why-does-my-search-not-finish/m-p/348509#M103157 <P>Are you selecting that "2 month window" from Real-time section of time range picker?</P> Mon, 29 Jan 2018 21:35:31 GMT https://community.splunk.com/t5/Splunk-Search/Why-does-my-search-not-finish/m-p/348509#M103157 somesoni2 2018-01-29T21:35:31Z https://community.splunk.com/t5/Splunk-Search/Why-does-my-search-not-finish/m-p/348510#M103158 <P>If you specified to search with a "2 month <A href="http://docs.splunk.com/Splexicon:Timerangewindow">window</A>" that means you setup a <A href="http://docs.splunk.com/Splexicon:Realtimesearch">real-time search</A>, which is a continuously executing search.</P> <P>Instead you want to run a normal historic search (using the "Relative" section of the time range picker) to which the picker would instead read "Last 2 months"</P> Mon, 29 Jan 2018 21:37:56 GMT https://community.splunk.com/t5/Splunk-Search/Why-does-my-search-not-finish/m-p/348510#M103158 acharlieh 2018-01-29T21:37:56Z https://community.splunk.com/t5/Splunk-Search/Why-does-my-search-not-finish/m-p/348511#M103159 <P>Yes, i was selecting Real-time -&gt; 2 Months Ago</P> Mon, 29 Jan 2018 21:40:44 GMT https://community.splunk.com/t5/Splunk-Search/Why-does-my-search-not-finish/m-p/348511#M103159 fraser8 2018-01-29T21:40:44Z