Part of the problem is that sub-searches, joins, appends, etc. all run once per search. What you really want to do is runs a search per EVENT
Try this:
< find event X >
| eval start=_time, end=relative_time(_time,"+20m")
| table start end host <any other fields you want to reference in map search>
| map
search="search host=$host$ earliest=$start$ latest=$end$ <search for Y> "
| stats count AS "Count Event Y" by host
In this search your X search is just collecting variables for the map search. The map search then replaces the source event with all of the matches of the map search, unique to each source event. This means each source event gets its own timerange for the map search and can return more than one row. If you want run stats against each individual map search instead of at the end, you can add pipes in the the search term and then you only get one row back per X event.
As you can imagine, map searches are expensive so you want your source search to be as small as possible and your map search to be as efficient as possible
... View more