If you have a lot of events with "EVENT B" in your data, then you might be hitting the event limit for the subsearch (10k events). Therefore the subsearch will return only the first 10k events, which might only have a small number of IP addresses (if many events have the same IP address).   Using dedup will make the result count much smaller and probably have less than 50k IP addresses, so the subsearch can return all of the IP addresses to the first search and then do the filtering.    Side note: You might be able to do this using a single search (no subsearch) by doing something like the following (please note: you will need to create the event_flag field yourself using your own regex/match)   index=prod-* sourcetype="kube:service" ("Event A" earliest=-24h latest=-4h) OR ("Event B" earliest=-24h latest=-0h) | eval event_flag=if(match(_raw,"Event A"),"Event_A","Event_B") | stats values(event_flag) as event_flag dc(event_flag) as event_count by IPAddress | search event_count=1 event_flag="Event_A"       ... View more

You could try doing a concatenation of the fields in both the main alert, and also the summary index sub search and then compare those concatenated fields to determine if the results of the current alert were found in the summary index.  (Also, side note; you may need to enter a hardcoded earliest and latest time in your summary index sub search to ensure that you are looking at the correct time range for the summary indexed data)   You could try something like the following:   index=preos host IN(*) *GPU*: PCISLOT* | rex field=_raw "log-inventory.sh\[(?<id>[^\]]+)\]\:\s*(?<gpu>[^\:]+)\:\s*(?<Hardware_Details>.*)" | rex field=_raw "GPU.*PCISLOT.*VBIOS\:\s(?<ios>[^\,]+)" | search gpu=GPU* | eval gpu_ios=gpu." : ".ios | stats latest(_time) AS _time latest(*) AS * BY host gpu | bucket _time span=1m | bucket _time span=1m | appendpipe [| top 1 ios BY _time host | rename ios AS common_ios | table _time common_ios host] | eventstats max(common_ios) AS common_ios values(gpu_ios) AS gpu_ios BY _time host | table _time host gpu ios common_ios gpu_ios | rename _time as time | eval time=strftime(time,"%Y-%m-%d %H:%M:%S") | rename ios AS VBIOS_Version common_ios as Common_VBIOS_Version gpu_ios as GPU_VBIOS | where LEN(gpu)>1 AND VBIOS_Version!=Common_VBIOS_Version | eval concat_field=host.gpu.VBIOS_Version | join type=outer concat_field [search index=summary summary_type=test | table gpu orig_host VBIOS_Version | eval concat_field=orig_host.gpu.VBIOS_Version | eval is_found_in_summary_index="true" | table concat_field is_found_in_summary_index]   ... View more

Agree with @bpick.   You could add on something like the following to your search:   ...< original search > ... | eval action=case(Err="server timeout, try after sometime","Ignore",Err="Web service error","follow-up",Err="Address element not found","Ignore")   The challenge with the above is that you may need to create a case statement for many different values of the Err field, depending on what you want to set the Action field to.    Alternatively, if there will only ever be two values for Action (I.E. "Follow-Up" and "Ignore"), then you could do something like the following and adjust it as needed.    ... < original search > ... | eval Action=if(Err="Web service error" OR Err="Something else" OR Err="another thing","Follow-Up","Ignore")   This will assign "Follow-Up" to the specific Err values that you call out, and then assign "Ignore" to everything else.  ... View more

The issue with your first example is that when you use timechart, you lose the field reference for my_count because it gets wrapped up in the split by field (my_foobar). Essentially, if you use timechart before the last stats, you will notice when you view the data in statistics mode, the field called "my_count" does not exist as a "usable field" for the next part of the search.    Instead, if you swap out the timechart for another stats, you can do what you are wanting. See below:   earliest=-7d@d latest=-0d@d index=prod "<b>ERROR:</b>" | rex "foo:\ (?<my_foo>[^\ ]*)" | rex "bar:\ (?<my_bar>[^\<]*)" | eval my_foo = coalesce(my_foo,"-") | eval my_bar = coalesce(my_bar, "-") | rex mode=sed field=my_bar "s/[\d]{2,50}/*/g" | strcat my_foo " - " my_bar my_foobar | bin _time span=1d | stats count as my_count by _time my_foobar | stats avg(my_count)   This should give you output. ... View more