Strange behavior when searching on large events

[jambajuice]

I'm running Splunk 4.1.6 (89596) 64-bit on Windows 7. I'm using Chrome as my browser.

If I search on a sourcetype that has very large multi-line events (300 lines+) in an XML format. If I do a search on that sourcetype, it returns results. If I search on it again from the same Window, the search stops showing any progress indicator and never finishes. If I run the search a third time, Splunk says there are zero results.

But if I click on the Summary tab from the search app and click on that sourcetype, it displays the results properly.

Any idea how I can troubleshoot this?

Thx.

Craig

[Paolo_Prigione]

You should use a supported browser at first: Chrome and FF 3.6 are not supported right now.

I had great problems with Chrome too, so I now use FF or IE8.

[jambajuice]

When I run this search, Splunk generates like 10 GB of temp files and the search never finishes.

[jambajuice]

The total size of the XML source data is about 215 MB.

My search looks like this:

sourcetype="nvdb" score=* OR vuln_product=* | eval vuln_product=if(isnull(vuln_product),"N\A",vuln_product) | dedup cve_id | mvexpand vuln_product | rex field=vuln_product "(?i)(?P[^:]+):(?P[^:]+):(?P[^<]+)" | table cve_id,score,access_vector,access_complexity,authentication,integrity_impact,availability_impact,confidentiality_impact,vendor_name,product_name,version_name | outputlookup nvdb_database.csv