Is there a sub search limit in a single search?

[cresposh]

The subject states the question.... is there a limit on how many sub search I can use within a single query.

While doing queries, as an example:

index="MyIndex" source="MySource" computerName=*
| append [ search index="MyOtherIndex" source="MyOtherSource" computerName=*
| table computerName

Everything works as expected up to here

If I add another | append, the search just keeps on parsing search. No results, no errors.

The time preset does not seem to be an issue, I have used from 5 minutes up to 30 minutes where I can confirm there is a result for queries individually.

[to4kawa]

Additionally, by default subsearches return a maximum of 10,000 results and have a maximum runtime of 60 seconds. In large production environments it is quite possible that the subsearch in this example will timeout before it completes.

about subseach