appendcols and streamstats with alltime

[dataisbeautiful]

Hi all

I have a search that works for a range of a few days (eg earliest=-7d@d), but when running for alltime it breaks. I suspect this is an issue with appendcols or streamstats? Any pointers would be appreciated.

I'm using this to generate a lookup which I can then search instead of using an expensive alltime.

index=ndx sourcetype=src (device="PM4") earliest=0 latest=@d
| bucket _time span=1d
| stats max(value) as PM4Val by _time index
| appendcols 
[ search index=ndx sourcetype=src (device="PM2") earliest=0 latest=@d
| bucket _time span=1d
| stats max(value) as PM2Val by _time index
]
| streamstats current=f last(PM4Val) as LastPM4Val last(PM2Val) as LastPM2Val by index
| eval PM4ValDelta = PM4Val - LastPM4Val, PM2ValDelta = PM2Val - LastPM2Val
| table _time, index, PM4Val, PM4ValDelta, PM2Val, PM2ValDelta
| sort index -_time

[dataisbeautiful]

Doing an EVAL in STATS has made by day @ITWhisperer 

[ITWhisperer · Accepted solution]

Subsearches are usually limited to 50k events so an alltime subsearch it likely to have been (silently) terminated. Given that your index and source type are the same, try removing the subsearch

index=ndx sourcetype=src (device="PM4" OR device="PM2") earliest=0 latest=@d
| bucket _time span=1d
| stats max(eval(if(device="PM4",value,null()))) as PM4Val max(eval(if(device="PM2",value,null()))) as PM2Val by _time index

[PickleRick]

50k is the limit on subsearch when used with join command. The "normal" subsearch limit is much lower - it's 10k results.