Hi @jjohn149 , Maybe it's an impression, but the searches seem the same, probably the values in the conditions are different, but I would put the three searches in one, thus also avoiding the limi...
See more...
Hi @jjohn149 , Maybe it's an impression, but the searches seem the same, probably the values in the conditions are different, but I would put the three searches in one, thus also avoiding the limit of 50,000 results of the subsearch; so in my example I will use condition1, condition2 and condition3 to adapt to your real need: index=osp source=xxx EVENT_TYPE IN (event_type1, event_type2, event_type3) EVENT_SUBTYPE IN (event_subtype1, event_subtype2, event_subtype3)
field1=* field3 IN (field31, field32, field33) field4=""
| eval DATE=strftime(strptime(_time, "%Y%m%d"), "%Y-%m-%d")
| stats
latest(eval(if(field3=field31))),source,"") AS example1
latest(eval(if(field3=field32))),source,"") AS example2
latest(eval(if(field3=field33))),source,"") AS example3
by field5 field6 DATE Ciao. Giuseppe