appendcols with timechart when queried for longer window - appendcols results empty

[sethuk555]

Hi,

index=test sourcetype=access "READ/1.1" idvalue="" | timechart count(idvalue) as TotalRequests span=30m | appendcols [ search "READ/1.1" idvalue="" | timechart dc(idvalue) as Distinctrequests span=30m ] | eval Repeatedrequests=TotalRequests - Distinctrequests

With the above query I need to just pull the total and unique requests.For smaller window the query results are fine.If the search duration is for longer window say 7 days then the appendcols search "Distinctrequests" values are 0 in the beginning of the search window even though its not 0 actually.

Please let me know if any corrections in the query to be made.

[sundareshr]

You have a idvalue="" in your root search, which could probably be why you're getting 0 results. Change that to idvalue=*