You should replace that sub search e.g. looking all those events in the same time. Then check if that event belongs to your current subsearch's timeframe and add this retentionFlg=1 otherwise set it retentionFlg=0.
By that way it should works and actually it should works even faster with less resources.
Also try to avoid command table, use instead fields if possible as fields can run on indexer side instead of table which always run on SH level.