(index=ad source=otl_aduserscan) OR (index=summary source="otl - engineering - jira au tickets" )
| eval samAccountName=coalesce(samAccountName,Username)
| chart count by samAccountName index
| where summary=0
| table samAccountName
This solution avoids any subsearch limitations (time or size of results). It may also be much faster. Finally, you can easily debug this search by running just the first 2-3 lines to "see what you get."
If your subsearch result is getting truncated, you should see additional data since you're using NOT command (less records subsearch returns, less records will get filtered). Does the value of field Username in your summary index and value of field samAccountName match exactly? Give this a try as well.
|fields samAccountName, enabled
|search NOT [search index=summary source="otl - engineering - jira au tickets"
|stats count by Username | eval samAccountName="*".Username."*" | table sasmAccountName ]