Why Splunk query returns values when run as separate search, but is not working as a subsearch?

[tehale]

My actual search
sourcetype="xyz" Operation=q | eval msg=if(Status == "fail",[search sourcetype="xyz" Operation="p" Status="Fail" |rename message as errorMessage| eval errorMessage=replace(errorMessage,":","")|return $errorMessage ],"successful")|table Status,platform,msg

does not gives values and when ran [search sourcetype="xyz" Operation="p" Status="Fail" |rename message as errorMessage| eval errorMessage=replace(errorMessage,":","")|return $errorMessage ] separately works fine.

I am not sure what is missing.

[jimodonald]

Your sub search could be timing out before it completes. The default time is 60 seconds, so if your search runs longer than that, it could just be getting killed before it can return results.

References:
http://docs.splunk.com/Documentation/Splunk/6.1.4/Search/Aboutsubsearches

http://docs.splunk.com/Documentation/Splunk/6.1.4/admin/Limitsconf
Look for the [subsearch] section.