I found the solution. In the end, it boiled down to a stupid mistake in a defined macro. My search really looked like this: `my_search(param1, param2)`
| `fixedrange` ...which expanded to the ...
See more...
I found the solution. In the end, it boiled down to a stupid mistake in a defined macro. My search really looked like this: `my_search(param1, param2)`
| `fixedrange` ...which expanded to the following snippet from my original question: ```from macro "my_search":```
...
| table _time, y1, y2, y3, ..., yN
```from macro "fixedrange":```
| append [
| makeresults
| addinfo
| eval x=mvappend(info_min_time, info_max_time)
| mvexpand x
| rename x as _time
| eval _t=0
| table _time, _t
] But `my_search` was defined like this: | search index=... sourcetype=... param1=... param2=... Note the leading pipe, which shouldn't have been there! Now, the search optimization produced different results, depending on whether the 2nd macro was applied or not. Case A (fast): `my_search(param1, param2)`
... produced:
| search (sourcetype=... param1=... param2=...)
| search index=...
| ... Case B (slow): `my_search(param1, param2)`
| `fixedrange`
... produced:
| search
| search (index=... sourcetype=... param1=... param2=...)
| ... ... and obviously the first search term in case B was causing the headache, although the final result set was identical in both cases. Ouch!