Reporting

Why am I getting a timeout error using the append command?

cindygibbs_08
Communicator

Hello guy I hope everyone is doing great, I am creating a dashboard with a single visualization using a query that looks a lot like this one:

 

 

| multisearch
[ search index="OP" and sourcetype="XYU"
| search OPE="VOUCH" AND STATUS IN ("PEN", "REPL")
| fields OPE, STATUS, ATH]
[ search index="DEPARTS" and sourcetype="CLIENTE_NOT_VIP"
| search ATH="OK" AND CLIENT!="YK" AND REPORT="SERVICES_IUJ*"
| fields ATH, REPORT]
| stats values(*) as * by ATH

 

 


and it does not matter what the span of time for the search is, it always gives a proper results with no errors, for the purpose of this question I will call this single query "Query A"

But Today I decided to use create a table using the | append command along with the last query and a new one and for the life of mine I swear it did not work out as expected or as it does outside the | append command...  if I use it for a search period of one or 2 days it works fine BUT..When I use it let's say for  a time period of more than 20 days I get different results and I get an error that says: 
[subsearch]: Search auto-finalized after time limit (60 seconds) reached.

is it not ok to use a multisearch in the append command?

I do not know what is going on... or how to avoid this...because "Query A" works fine everytime I use it on splunk butI noticed this error whenever I try to use "Query A" inside an append command for a period of time of more than 20 days... I will be so thankful if any of you could point out what is going on.. or please how to avoid this..

kindly, Cindy

Labels (1)
0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.