Why am I getting a timeout error using the append command?

cindygibbs_08 — Mon, 14 Jun 2021 17:38:46 GMT

Hello guy I hope everyone is doing great, I am creating a dashboard with a single visualization using a query that looks a lot like this one:

| multisearch [ search index="OP" and sourcetype="XYU" | search OPE="VOUCH" AND STATUS IN ("PEN", "REPL") | fields OPE, STATUS, ATH] [ search index="DEPARTS" and sourcetype="CLIENTE_NOT_VIP" | search ATH="OK" AND CLIENT!="YK" AND REPORT="SERVICES_IUJ*" | fields ATH, REPORT] | stats values(*) as * by ATH

and it does not matter what the span of time for the search is, it always gives a proper results with no errors, for the purpose of this question I will call this single query "Query A"

But Today I decided to use create a table using the | append command along with the last query and a new one and for the life of mine I swear it did not work out as expected or as it does outside the | append command... if I use it for a search period of one or 2 days it works fine BUT..When I use it let's say for a time period of more than 20 days I get different results and I get an error that says:
[subsearch]: Search auto-finalized after time limit (60 seconds) reached.

is it not ok to use a multisearch in the append command?

I do not know what is going on... or how to avoid this...because "Query A" works fine everytime I use it on splunk butI noticed this error whenever I try to use "Query A" inside an append command for a period of time of more than 20 days... I will be so thankful if any of you could point out what is going on.. or please how to avoid this..

kindly, Cindy

topic Why am I getting a timeout error using the append command? in Reporting

Why am I getting a timeout error using the append command?