After upgrade from 7.0.x to 7.2.7, search time with multiple subsearch increase from several seconds to more than 1 hr

[daniel_splunk]

Have a search with many subsearch and append command like below pattern.

| makeresults 
| eval abcd="acded" 
| append [| makeresults 
| eval abcd="acded"] 
| append [| makeresults 
| eval abcd="acded"]
| append [| makeresults 
| eval abcd="acded"] 
| append [| makeresults 
| eval abcd="acded"] 

In version 7.0.x, search take several seconds to complete but after upgrade to 7.2.7, it take more than 1 hour to complete.

[daniel_splunk]

You are hitting a bug about "search time increases exponentially or factorially with number of subsearches".

This bug id: SPL-173898

This had been fixed in the following release.
7.1.10
7.2.9
7.3.3

To workaround this, you need to break down the searches into smaller ones.