Result counter
The N of M hits number above the result list, and how it interacts with Load more.
Result counter
The right side of the search toolbar shows the result count for the current query.
What the two numbers mean
N is the number of events visible on the current page (usually 100 unless your result set is smaller).
M is the total number of events that match your query in the selected time range, ignoring pagination.
So 12 OF 2,341 HITS means there are 2,341 matching events in total, and the first 12 are currently rendered (the result set was smaller than the page size). 100 OF 2,341 HITS means you are on the first page of 24 pages worth of results.
If M is missing (just 12 HITS), the total-count query was unable to complete in time. The result list is still correct. This rarely happens but is non-fatal.
How it changes when you click Load more
The Load more button at the bottom of the list reads LOAD MORE (2,241 REMAINING) when M is known. Clicking it appends the next 100 events to the list. The counter then updates: 200 OF 2,341 HITS. Repeat until the button disappears.
Why it matters
Without the M number, you would not know whether the 100 events on screen are "everything" or "a small fraction". For an investigation that depends on completeness (every kick, every chargeback, every cheat flag) that distinction is critical.
What the duration number is
The small 8ms next to the hit count is how long the server took to compute the result. It does not include network time or the count query. It is mostly useful for spotting unexpectedly slow queries: a 1500ms reading on a normal query suggests the server is under load.
Group-by results
When your query has a group by clause, the counter shows the number of groups rather than events. The OF M suffix is omitted because the server does not run a separate "count of groups" query: the group count IS the result set size.