Search job inspector discrepancies

[responsys_cm]

I have a search inputs a fairly large lookup table (150 MB). The execution costs are shown as:

Execution costs

Duration (seconds) Component Invocations Input count Output count

21.608 command.inputlookup 1 - 450,000

0.001 dispatch.check_disk_usage 1 - -

0.001 dispatch.createProviderQueue 1 - -

0.004 dispatch.evaluate 1 - -

0.004 dispatch.evaluate.inputlookup 1 - -

0.005 dispatch.writeStatus 5 - -

0.053 startup.handoff 1 - -

But the message the top says:

This search has completed and has returned 402,461 results by scanning 0 events in 46.318 seconds.

If the execution costs are barely adding up to 22 seconds, why is the whole search taking 46 seconds? What accounts for the other 24 seconds?

Thanks.

C

[drrushi_splunk]

Is that the complete Search Inspector output? It seems incomplete. What version of Splunk is this?