I have the following query:
|tstats values(field1) as f1 values(field2) as f2 where index=INDEX1 [|tstats count where index=INDEX2 by field3 | table field3 | rename field3 as f3] by f3 | sort -fX
What I execute the query above I got the following:
Subsearch produced 65000000 results, trunacting to maxout 50000
What can I do to solve it?
What are you trying to do with this search?
@yko84109, please follow the instructions given by @inventsekar at Subsearch produced 50000 results, truncating to maxout 50000