Normal index query :
searchA[search search B|stats count by _time,BusinessIdentifier|return BusinessIdentifier]|stats min(_time) as E by BusinessIdentifier
Tstats query:
|tstats min(_time) as E from datamodel=A where nodename=B [|tstats dc(Fusion.BusinessIdentifier) as "Fusion" from datamodel=A where nodename=C by Fusion.BusinessIdentifier|return Fusion.BusinessIdentifier]|stats min(_time) as E by Fusion.BusinessIdentifier
I assume both 'tstats' in your search works independently. Are you missing "search" and minor change ?
| tstats count from datamodel=A where nodename=B | search [|tstats dc(Fusion.BusinessIdentifier) as "Fusion" from datamodel=A where nodename=C by Fusion.BusinessIdentifier|return Fusion.BusinessIdentifier]|stats min(_time) as E by Fusion.BusinessIdentifier
It is passing only one BusinessIdentifier. If i put something like this:
| tstats count from datamodel=A where nodename=B | search [|tstats dc(Fusion.BusinessIdentifier) as "Fusion" from datamodel=A where nodename=C by Fusion.BusinessIdentifier|return 10000 Fusion.BusinessIdentifier]|stats count as E by Fusion.BusinessIdentifier
it is working.
But i want to pass all the identifiers..numbers should not limit.
I tried with limit=0 and also tried rename Fusion.BusinessIdentifier as search.
Both not working.