https://community.splunk.com/t5/Splunk-Search/Why-Splunk-query-returns-values-when-run-as-separate-search-but/m-p/161170#M45591 <P>Your sub search could be timing out before it completes. The default time is 60 seconds, so if your search runs longer than that, it could just be getting killed before it can return results.</P> <P>References:<BR /> <A href="http://docs.splunk.com/Documentation/Splunk/6.1.4/Search/Aboutsubsearches">http://docs.splunk.com/Documentation/Splunk/6.1.4/Search/Aboutsubsearches</A></P> <P><A href="http://docs.splunk.com/Documentation/Splunk/6.1.4/admin/Limitsconf">http://docs.splunk.com/Documentation/Splunk/6.1.4/admin/Limitsconf</A><BR /> Look for the [subsearch] section.</P> Mon, 13 Oct 2014 16:40:29 GMT jimodonald 2014-10-13T16:40:29Z https://community.splunk.com/t5/Splunk-Search/Why-Splunk-query-returns-values-when-run-as-separate-search-but/m-p/161169#M45590 <P>My actual search <BR /> sourcetype="xyz" Operation=q | eval msg=if(Status == "fail",[search sourcetype="xyz" Operation="p" Status="Fail" |rename message as errorMessage| eval errorMessage=replace(errorMessage,":","")|return $errorMessage ],"successful")|table Status,platform,msg</P> <P>does not gives values and when ran [search sourcetype="xyz" Operation="p" Status="Fail" |rename message as errorMessage| eval errorMessage=replace(errorMessage,":","")|return $errorMessage ] separately works fine.</P> <P>I am not sure what is missing.</P> Mon, 13 Oct 2014 15:37:59 GMT https://community.splunk.com/t5/Splunk-Search/Why-Splunk-query-returns-values-when-run-as-separate-search-but/m-p/161169#M45590 tehale 2014-10-13T15:37:59Z https://community.splunk.com/t5/Splunk-Search/Why-Splunk-query-returns-values-when-run-as-separate-search-but/m-p/161170#M45591 <P>Your sub search could be timing out before it completes. The default time is 60 seconds, so if your search runs longer than that, it could just be getting killed before it can return results.</P> <P>References:<BR /> <A href="http://docs.splunk.com/Documentation/Splunk/6.1.4/Search/Aboutsubsearches">http://docs.splunk.com/Documentation/Splunk/6.1.4/Search/Aboutsubsearches</A></P> <P><A href="http://docs.splunk.com/Documentation/Splunk/6.1.4/admin/Limitsconf">http://docs.splunk.com/Documentation/Splunk/6.1.4/admin/Limitsconf</A><BR /> Look for the [subsearch] section.</P> Mon, 13 Oct 2014 16:40:29 GMT https://community.splunk.com/t5/Splunk-Search/Why-Splunk-query-returns-values-when-run-as-separate-search-but/m-p/161170#M45591 jimodonald 2014-10-13T16:40:29Z