subsearch

[Shark2112]

Hey everyone.

I want to search updated events via jira rest for adding them in my index after. My search work fine one day, but next not, and i can't understand why.

Finding updated events in my index:
index=jira earliest=-1d | stats latest(Updated) by Key | table Key, latest(Updated) | rename latest(Updated) as Updated | sort -Updated
Key Updated
IFWEBV-17 2016-11-09T10:29:30.000+0300
IFWEBM-151 2016-11-08T20:38:59.000+0300
IFWEBB-16 2016-11-08T14:43:51.000+0300

Finding updated events at Jira server:
Key Updated
IFWEB-30 2016-11-09T12:09:31.000+0300
IFWEBV-17 2016-11-09T10:29:30.000+0300
IFWEBM-151 2016-11-08T20:38:59.000+0300
IFWEBB-16 2016-11-08T14:43:51.000+0300

So i make subsearch and want to find IFWEB-30 with updated date:
index=jira earliest=-1d | stats latest(Updated) by Key | table Key, latest(Updated) | rename latest(Updated) as Updated
| search NOT [| jirarest jqlsearch "updated >= -1d" | table Key, Updated]
No results found.

Why? Yesterday i watched this searches and all work fine, but today.......

[Shark2112 · Accepted solution]

I simplified reqeust and now it's work fine
| jirarest jqlsearch "updated >= -1d"
| search NOT [search index=jira earliest=-2d | stats latest(Updated) by Key | table Key, latest(Updated) | rename "latest(Updated)" as Updated]
| outputcsv myexport