Hi, the times splunk shows in "inspect job" are totally unrelated to reality: This search has completed and has returned 11 results by scanning 18 events in 2.301 seconds That's for a search which took 23 seconds to show up in the browser, which was also documented in "inspect job" by: 23.24 startup.handoff The funny thing is, that splunk then can also show results after 3 seconds, but still have a startup.handoff of 20+ seconds. So it can be off by factor 10 in both directions, what's the use of that? Regards Arnim
... View more