How to Retrieve Matched Events in Splunk Without Waiting for Search Completion?

[pinggru]

Hello Splunk Community,

I'm encountering an issue with my search queries in Splunk that I hope someone can help me with. When I run a search, Splunk often indicates that a subset of events has matched (e.g., 2 of 10,000 events matched), but the "Events" panel only shows the count in brackets and does not display the actual results.

The main concern here is that these long-running queries frequently fail, and no data is returned at all. This is particularly frustrating when I know that some events have already matched.

What I'm looking for is a way to have Splunk return the matched events as they are found, without waiting for the entire search to be completed. In other words, if 2 events have matched, I'd like to see those 2 events immediately, even if the search is still ongoing.

Is there a configuration or query modification that would allow this behavior? Any guidance or insights would be greatly appreciated.

Thank you in advance for your assistance! I have also attached a screenshot for reference.

[inventsekar]

Hi @pinggru ...for the DAG error, you can search here in this community, you can find many solutions. 

for the first issue, .. pls update us your search query (remove important details like username, etc..).. generally this issue represents the search query got some simple issues(mostly on the last part.. after the last "|"))