When deselecting a search term in Splunk, what is the effect on the ongoing search?

When a search term is deselected in Splunk, the ongoing search does not re-run. This means that any adjustments made by removing a term will not immediately result in the search being re-executed. Instead, Splunk retains the current search results based on the existing query state, and users can view the results as they were at the time of the adjustment.

The rationale behind this behavior is to enhance user experience by allowing real-time exploration of data without unnecessary interruptions or delays that would occur if the search had to restart. Users can make further adjustments, including adding or removing terms, while maintaining the flexibility to analyze the results without facing performance overhead from frequent re-runs. This approach facilitates a more dynamic and user-friendly interaction with search results in Splunk.