Which returns all my statistical and transactional records for msgIDs whose statistical record shows they took more than 10 seconds to complete. The problem is that when there are no results returned from the subsearch, the format passed to the parent search is "NOT()", which causes all records from the time period to be displayed. This is highly confusing to the user.
How can I abort the parent search and show no results when the subsearch returns nothing?
It should not be the case that "NOT ()" matches everything. By convention, "()" is the same as "*" to Splunk (this is because the empty set of conjuncts should match everything). So
"NOT ()" is the same as "NOT *" which should match nothing.
I verified this by the search:
[stats count | search count = 1] | stats count
This yields an empty subsearch which results in "NOT ()" and no results come out.