Hello guy I hope everyone is doing great, I am creating a dashboard with a single visualization using a query that looks a lot like this one:
| multisearch
[ search index="OP" and sourcetype="XYU"
| search OPE="VOUCH" AND STATUS IN ("PEN", "REPL")
| fields OPE, STATUS, ATH]
[ search index="DEPARTS" and sourcetype="CLIENTE_NOT_VIP"
| search ATH="OK" AND CLIENT!="YK" AND REPORT="SERVICES_IUJ*"
| fields ATH, REPORT]
| stats values(*) as * by ATH
and it does not matter what the span of time for the search is, it always gives a proper results with no errors, for the purpose of this question I will call this single query "Query A"
But Today I decided to use create a table using the | append command along with the last query and a new one and for the life of mine I swear it did not work out as expected or as it does outside the | append command... if I use it for a search period of one or 2 days it works fine BUT..When I use it let's say for a time period of more than 20 days I get different results and I get an error that says:
[subsearch]: Search auto-finalized after time limit (60 seconds) reached.
is it not ok to use a multisearch in the append command?
I do not know what is going on... or how to avoid this...because "Query A" works fine everytime I use it on splunk butI noticed this error whenever I try to use "Query A" inside an append command for a period of time of more than 20 days... I will be so thankful if any of you could point out what is going on.. or please how to avoid this..
kindly, Cindy
