This is somewhat normal if you are piping to many "rolling up"-type commands (e.g.
stats) because Splunk is designed to give you preliminary (NOT PARTIAL) results along the way while your search is processing. Normally this is very useful but in some cases like yours, it can be misleading and confusing. Such complicated searches also may take a while to finalize so that is normal, too. You should never forget that any search may show preliminary results that are later properly vacated using the plenary results in the finalization stage. If you believe that you should have results, then you almost certainly have a mistake in your search string. To find the mistake, throw away each post-pipe clause, one by one, starting from the right side and make sure at each stage that the preliminary stages' results look the way they should. As the others have said, we really cannot tell more without your exact search and some real sample data.
Please share your search.
Also for finding issue, try to run your query in small parts,
like if your query is index=abc sourcetype=xyz | <part1> | <spart2> | stats <somefunction> by <field>
so first run normally before part 1 then with part 2 , this will help you in determining which part is creating issue.
Yes... You are both @intelsubham and @richgalloway are correct..
I am getting zero results due to a custom command in my query.
(Splunk docs.. says python custom command will returns only 50000 records.... and the last 50000 records are filtered by my query condition)..
does it show "results" while executing or are you just seeing events returned? - And yes. we need to see your search.