I'm having the same problem, not making any headway. Have you checked your search.log in the inspector window? Mine is showing a collector failure to write (before it calls the CANCEL), but can't figure out why. Looking at the $SPLUNKHOME/var/log/*.log may be helpful. I can see some errors there, but none have really led me to the answer. It's almost like it is hitting a search limit and stopping.
... View more