Why am I getting different results with filtering and using the append command?

[Gchouane]

Hello ,
I would like to generate a customer analysis.

I must use order and a customer segmentation.

I write a search with one customer:
Search1 :

index=order sourcetype="order" id_customer=1780186  
| append [| search index=segmentation id_customer=1780186   | eval capacity=1 | table id_customer, segment , capacity]
| search id_customer=1780186 
| table id_customer, segment ,id_market_order

It returns customer order list and segmentation. (225 lines)

If I remove all filter , the new search returns 224 lines (just order list).
Search 2 :

index=order sourcetype="order"  
| append [| search index=segmentation  | eval capacity=1 | table id_customer, segment , capacity]
| search id_customer=1780186 
| table id_customer, segment ,id_market_order

If I add filter, the search 3 returns 225 lines.
Search 3 :

index=order sourcetype="order" id_customer=1780186  
| append [| search index=segmentation  | eval capacity=1 | table id_customer, segment , capacity]
| search id_customer=1780186 
| table id_customer, segment ,id_market_order

Have you an idea?

Thanks you.

[lguinn2 · Accepted solution]

There is a default maximum number of events that can be returned from a subsearch. If you look at the search job inspector after running search #2, I think you may find that you have exceeded the maximum and therefore have lost one of your results.

However, this search dos not need a subsearch at all. This will work and be much faster:

id_customer=1780186 (index=order sourcetype="order") OR index=segmentation 
| table id_customer, segment, id_market_order

If you want to ensure that the order data precedes the segmentation data in the resulting table, you can do this

id_customer=1780186 (index=order sourcetype="order") OR index=segmentation 
| eval sequence=if(index=="order",1,2)    
| sort id_customer, sequence, _time
| table id_customer, segment, id_market_order