It would help to know which API call you're using for the query. A quick search of the docs shows the saved/searches endpoint as a dispatch.max_count setting that defaults to 500,000, but that seems an unlikely cause in this context. Why are you including index=_* in the query? That searches all of Splunk's internal logs rather than the data you have submitted to Splunk. For faster performance, wildcard filters, like index=_* and index=*, should be avoided in favor of specific index names, like index=_internal or index=main. Further, real-time searches should be avoided whenever possible (and it's almost always possible). A real-time ties up a CPU on the search head and each indexer, preventing other searches from using them.
... View more
