Sub-searches using savedsearch returns results, but columns are labeled "NULL"

[yacht_rock]

Using savedsearch and timechart, I'm getting NULL where I'd expect the values of "myfield"

Base search (@m to -1h@h)

 index=myindex myfield=*FOO* | timechart span=1h count by myfield

And aggregating searches like

 | savedsearch mysavedsearch1 | timechart span=1d count by myfield

Aggregating search has time stamps in correct grouping, but the other column is labeled NULL when it should be values like myfield-foo, foo-myfield, etc..

[somesoni2 · Accepted solution]

Once you fire your first query, the columns available are _time and value of myfield (not the column with name myfield). So when you're using your second search, it'll return NULL as there is no column with name myfield. This is how you should implement this

Base search (@m to -1h@h)

 index=myindex myfield=*FOO* | bucket span=1h _time | stats count by _time myfield

And aggregating searches like

| savedsearch mysavedsearch1 | timechart span=1d sum(count) by myfield