Map command with loadjob not returning all results

[eli_mz]

I've run into an issue using the map command in combination with the loadjob command. I've put the string below together that is getting all of my fired alerts and then sending them to the loadjob command to display the results for each fired alert. Over the last 7 days I have ~2,000 fired alerts with ~3,900 results from those alerts but the string below only returns ~600 of those results.

index=_audit action=alert_fired alert_actions="*mailtosiem*" OR ss_name="My Extra Alert" | table sid, triggered_alerts | map search=" | loadjob $sid$"

I've tried setting maxsearches up to 100,000 but the search still only returns the 600 results. Can anyone shed any light on this? Am I approaching this wrong?

[DalJeanis]

You may be running into timeout issues of various kinds, as well as, potentially, out-of-memory issues.

It would seem to be a more scalable approach, although a PITA to redo all the architecture, to send those all to a summary index as they are generated.

Since that would require a bunch of mantime, just check whether your above strategy would work correctly for, say, the last 15 minutes. If it does, then run it every 15 minutes to send the results to a summary index, and you can scan the summary index to see what happened over the last day.