This is somewhat normal if you are piping to many "rolling up"-type commands (e.g. stats) because Splunk is designed to give you preliminary (NOT PARTIAL) results along the way while your search is processing. Normally this is very useful but in some cases like yours, it can be misleading and confusing. Such complicated searches also may take a while to finalize so that is normal, too. You should never forget that any search may show preliminary results that are later properly vacated using the plenary results in the finalization stage. If you believe that you should have results, then you almost certainly have a mistake in your search string. To find the mistake, throw away each post-pipe clause, one by one, starting from the right side and make sure at each stage that the preliminary stages' results look the way they should. As the others have said, we really cannot tell more without your exact search and some real sample data.
