The progress bar went away because it only shows progress for the main search pipeline. In the rewritten version it's the subsearch that is doing most of the work and the outer search is comparatively zippy so the JobProgressIndicator only appears at the end for a very brief time. You can probably confirm this by running them separately in the charting view. ie run sourcetype=postfix_syslog *$Username$* vs sourcetype=postfix_syslog (message_pid=<pidA> OR message_pid=<pidB> OR message_pid=<pidC> ...) | transaction keepevicted=true (Its the prefix+postfix search on Username that makes it expensive, because it has to get all of the events off of disk and then scan them in memory. ) I dont think there's any way to get the main job to reflect the progress of the subsearch job, and that JobProgressIndicator definitely only responds to the main job. One quite different solution you might try: a) extract the username field if it isn't already. b) create a summary index search that runs every 10mins or so that maps usernames to pids. sourcetype=postfix_syslog | stats count by username, message_pid c) then you can search for this sourcetype=postfix_syslog [ index=summary username="*$Username$*" | dedup pid ] | transaction keepevicted=true fields=message_pid maxspan=3m maxpause=1m | timechart count by host Of course, removing the asterisks around Username will probably make this problem go away as well... ... View more