I believe these are some of the fields that are also available as properties through the Job Inspector. Docs: http://docs.splunk.com/Documentation/Splunk/7.0.2/Search/ViewsearchjobpropertieswiththeJobInspector
For the terms you asked about in particular:
scan_count scanCount - The number of events that are scanned or read off disk
event_count eventCount - The number of events returned by the search.
result_count resultCount - The total number of results returned by the search.
available_count eventAvailableCount - The number of events that are available for export.
drop_count dropCount - In real-time searches only, the number of possible events dropped due to queue size.
In other words, if I run a search, the number of events read off of disk for my search is scan_count , but the number of events that qualify for my search is event_count .
result_count could be the same as event_count if I was just retrieving events, but if I did some form of statistics, in my search that could be different. ( For example if my search ended with | stats count , result_count would be 1). available_count would be more than zero if I was able to export any events (i.e. if I had events, and I was doing a non-transforming search, or I was running in verbose mode ).
... View more