Have a search with many subsearch and append command like below pattern.
| makeresults
| eval abcd="acded"
| append [| makeresults
| eval abcd="acded"]
| append [| makeresults
| eval abcd="acded"]
| append [| makeresults
| eval abcd="acded"]
| append [| makeresults
| eval abcd="acded"]
In version 7.0.x, search take several seconds to complete but after upgrade to 7.2.7, it take more than 1 hour to complete.
You are hitting a bug about "search time increases exponentially or factorially with number of subsearches".
This bug id: SPL-173898
This had been fixed in the following release.
7.1.10
7.2.9
7.3.3
To workaround this, you need to break down the searches into smaller ones.