https://community.splunk.com/t5/Splunk-Search/Search-job-inspector-discrepancies/m-p/41148#M178919 <P>Is that the complete Search Inspector output? It seems incomplete. What version of Splunk is this? </P> Wed, 02 Oct 2013 18:19:48 GMT drrushi_splunk 2013-10-02T18:19:48Z https://community.splunk.com/t5/Splunk-Search/Search-job-inspector-discrepancies/m-p/41147#M178918 <P>I have a search inputs a fairly large lookup table (150 MB). The execution costs are shown as:</P> <P>Execution costs</P> <P>Duration (seconds) Component Invocations Input count Output count<BR /><BR /> 21.608 command.inputlookup 1 - 450,000<BR /><BR /> 0.001 dispatch.check_disk_usage 1 - -<BR /><BR /> 0.001 dispatch.createProviderQueue 1 - -<BR /><BR /> 0.004 dispatch.evaluate 1 - -<BR /><BR /> 0.004 dispatch.evaluate.inputlookup 1 - -<BR /><BR /> 0.005 dispatch.writeStatus 5 - -<BR /><BR /> 0.053 startup.handoff 1 - - </P> <P>But the message the top says: </P> <P>This search has completed and has returned 402,461 results by scanning 0 events in 46.318 seconds.</P> <P>If the execution costs are barely adding up to 22 seconds, why is the whole search taking 46 seconds? What accounts for the other 24 seconds?</P> <P>Thanks. </P> <P>C</P> Mon, 28 Sep 2020 13:22:40 GMT https://community.splunk.com/t5/Splunk-Search/Search-job-inspector-discrepancies/m-p/41147#M178918 responsys_cm 2020-09-28T13:22:40Z https://community.splunk.com/t5/Splunk-Search/Search-job-inspector-discrepancies/m-p/41148#M178919 <P>Is that the complete Search Inspector output? It seems incomplete. What version of Splunk is this? </P> Wed, 02 Oct 2013 18:19:48 GMT https://community.splunk.com/t5/Splunk-Search/Search-job-inspector-discrepancies/m-p/41148#M178919 drrushi_splunk 2013-10-02T18:19:48Z