why can't I get 7 days of data in appendcols search?

[Min1025]

Hi All,

I have a search for comparing data between 2 weeks, I can get data for 7 days in first search, but only got 2 days data in appendcols search, why can't I get 7 days of data in appendcols search?

  index=xxx  earliest=-7d@d latest=-0d@d | eval Date1 = (date_year + "-" + date_month + "-" + date_mday) 
    | stats count AS SearchThisWeek by Date1
    | appendcols  [ search index=xxx  earliest=-14d@d latest=-10d@d | eval Date2 = (date_year + "-" + date_month + "-" + date_mday) | stats count AS SearchLastWeek by Date2] 
    | eval SearchFluctuatePerc=(SearchThisWeek-SearchLastWeek)/ SearchLastWeek 
    | fields Date1, SearchThisWeek, Date2, SearchLastWeek, SearchFluctuatePerc

[Min1025]

I found a solution for this, just need to set the maxtime and timeout| appendcols maxtime=600 timeout=600

[woodcock]

The appendcols is a subsearch which is limited to 50.5K results returned to the main search. When I need to do something like this, I search for the broadest range (in this case earliest=-14d@d latest=-0d@d and then preclude the stuff that I don't need with _time>foo AND time<bar where you calcluate foo and bar with a subsearch and relative_time.

[Min1025]

Hi woodcock,

Do you have an example for this kind of search?

[jkat54]

I’d you do it without the date evals, does it work?

If so use strftime on _time to format it.

Like this

| eval Date2=strftime(_time,”%Y-%m-%d”)

The date_mday etc are not reliable for statistical functions.

[Min1025]

Hi, I tried using strftime on _time and still see the same issue.

[HiroshiSatoh]

I think that it is because data does not exist.
Does the sub search result for 7 days?

[Min1025]

Hi HiroshiSatoh,

I tried the sub search and could get results for 7 days(2018/6/15—2018/6/21).

Thanks,
Min