Hello Splunk Community, I'm encountering an issue with my search queries in Splunk that I hope someone can help me with. When I run a search, Splunk often indicates that a subset of events has matched (e.g., 2 of 10,000 events matched), but the "Events" panel only shows the count in brackets and does not display the actual results. The main concern here is that these long-running queries frequently fail, and no data is returned at all. This is particularly frustrating when I know that some events have already matched. What I'm looking for is a way to have Splunk return the matched events as they are found, without waiting for the entire search to be completed. In other words, if 2 events have matched, I'd like to see those 2 events immediately, even if the search is still ongoing. Is there a configuration or query modification that would allow this behavior? Any guidance or insights would be greatly appreciated. Thank you in advance for your assistance! I have also attached a screenshot for reference.
... View more
