https://community.splunk.com/t5/Splunk-Search/disapearing-results/m-p/19661#M3005 <P>Can you post the actual search?</P> Tue, 30 Apr 2013 02:08:10 GMT sideview 2013-04-30T02:08:10Z https://community.splunk.com/t5/Splunk-Search/disapearing-results/m-p/19660#M3004 <P>I have a search that will show the results populating as it runs. Then out of nowhere the results drop to 0 and the search just continues to run till finished. I am just using a stats command so there are no commands that I am using like WHERE or anything else that would cause the results to drop to 0 if a condition is met. The search does take quite a while to run, over a hour. Has anyone experience this before? I am on 4.3.5</P> <P>When i run the same search from another search head that has the same search peers the search finishes with all the results listed. </P> <P>Could there be some type of dispatch limit that I am reaching? I have tried running this search on demand and as a saved search with the same results. </P> <P>I did notice that in the dispatch folder for this search that the results_preview.csv file will be there as the search runs and then as soon as the results drop to 0 the results_preview.csv file is gone.</P> Mon, 28 Sep 2020 13:48:17 GMT https://community.splunk.com/t5/Splunk-Search/disapearing-results/m-p/19660#M3004 cramasta 2020-09-28T13:48:17Z https://community.splunk.com/t5/Splunk-Search/disapearing-results/m-p/19661#M3005 <P>Can you post the actual search?</P> Tue, 30 Apr 2013 02:08:10 GMT https://community.splunk.com/t5/Splunk-Search/disapearing-results/m-p/19661#M3005 sideview 2013-04-30T02:08:10Z https://community.splunk.com/t5/Splunk-Search/disapearing-results/m-p/19662#M3006 <P>Turns out there was a clean up script that someone had running which was periodically clearing out files from the dispatch directory. DOH!</P> Tue, 30 Apr 2013 20:30:48 GMT https://community.splunk.com/t5/Splunk-Search/disapearing-results/m-p/19662#M3006 cramasta 2013-04-30T20:30:48Z https://community.splunk.com/t5/Splunk-Search/disapearing-results/m-p/19663#M3007 <P>Yeah, that's a really bad idea.</P> Tue, 30 Apr 2013 22:41:10 GMT https://community.splunk.com/t5/Splunk-Search/disapearing-results/m-p/19663#M3007 the_wolverine 2013-04-30T22:41:10Z