If I initially run a search, I get no results, but why do I get results running the same search 1 minute later?

[mrtolu6]

I'm seeing the following error message,

Problem replicating config (bundle) to search peer 'SPLUNKNAME:8089',Reading reply to upload: rv=-2, Receive from=https://SPLUNKNAME:8089 timed out; exceeded 60sec, as per=distsearch.conf/[replicationSettings]/sendRcvTimeout

I noticed if I run a search in Splunk, I will get no event (no result) for a search, but if I run that same search again a minute later, I will get events (results) for that same search command. What is causing this? What steps should I take to troubleshoot?

[woodcock]

Your bundle is too big and timing out when you attempt to send it to your indexers (automatically done when you search). The main thing that causes this is excessively large lookup tables. You can deploy the biggest ones manually to the indexer and then blacklist them from being distributed in your bundle (because they are already on the Indexers).

http://docs.splunk.com/Documentation/Splunk/6.4.1/DistSearch/Limittheknowledgebundlesize