I have a search that will show the results populating as it runs. Then out of nowhere the results drop to 0 and the search just continues to run till finished. I am just using a stats command so there are no commands that I am using like WHERE or anything else that would cause the results to drop to 0 if a condition is met. The search does take quite a while to run, over a hour. Has anyone experience this before? I am on 4.3.5
When i run the same search from another search head that has the same search peers the search finishes with all the results listed.
Could there be some type of dispatch limit that I am reaching? I have tried running this search on demand and as a saved search with the same results.
I did notice that in the dispatch folder for this search that the results_preview.csv file will be there as the search runs and then as soon as the results drop to 0 the results_preview.csv file is gone.
