Equivalent timechart correlation query without subsearch

[dzhangw7]

Can someone help create an equivalent query to the following, without using subsearch? There are probably too many results and the query does not complete.

index=my_index 
[search index=my_index ("Extracted entities" AND "'date': None") OR extracted_entities.date=null | stats count by entity_id | fields entity_id | format]
"Check something" | timechart count by classification

Basically I want to extract the list of entity_ids from this search: [search index=my_index ("Extracted entities" AND "'date': None") OR extracted_entities.date=null] where dates are null and then use those IDs to correlate in a second search "Check something" which has a field "classification", and then I want to do a timechart on the result to see a line graph of events where a date was missing from an event, plus with a given classification.

[PickleRick]

As @gcusello already pointed out - if your subsearch reaches to the same index as the outer search, it's pointless to do it this way. Limiting the base search is enough.

But if you want to correlate events from two different indexes, you'd need to search from both indexes at the same time (join conditions with OR) and then do some stats by common field.

Anyway,

| stats count by entity_id | fields entity_id

doesn't make much sense. It's enough to do

| stats values(entity_id) as entity_id

[gcusello]

Hi @dzhangw7 ,

why are you using a subsearch?

you can put all the conditions in the main search:

index=my_index "Check something" (("Extracted entities" AND "'date': None") OR extracted_entities.date=null)
| timechart count by classification

eventually adding a condition on identity_id

index=my_index "Check something" (("Extracted entities" AND "'date': None") OR extracted_entities.date=null) identity_id=*
| timechart count by classification

Ciao.

Giuseppe