I have a query that has two nested searches, it has been working correctly for at least a few years when I was using Splunk 5.x but I have recently updated to Splunk 6.1 and the nested queries are not working properly. The first one (1 day ago) will work on some days but not always, the second sub query (7 days ago) always returns the wrong results. I can take each of the searches and run them in the search, primary always works, the two sub searches will not work in smart move but if I change it to verbose mode it will work correctly. I first added a SearchMode and could see that my post query had the proper adhoc_search_level value set but it still world not work. Here is my query: index=caabistats | sort ~_time | head 1 | eval caa_cna_customer_count=(caa_customer_count+cna_customer_count)-customer_count | table customer_count, caa_customer_count, cna_customer_count, caa_cna_customer_count, total_found_devices, caa_found_devices, cna_found_devices, findit_found_devices | rename customer_count as "Total Customer Count", caa_customer_count as "CAA Customer Count", cna_customer_count as "CNA Customer Count", caa_cna_customer_count as "CAA and CNA Customer Count", total_found_devices as "Total Found Devices", caa_found_devices as "CAA Found Devices", cna_found_devices as "CNA Found Devices", findit_found_devices as "FindIt Found Devices" | transpose | rename column as "Basic Information", "row 1" as Current | join[search index=caabistats **| sort ~_time | head 2 | tail 1** | eval caa_cna_customer_count=(caa_customer_count+cna_customer_count)-customer_count | table customer_count, caa_customer_count, cna_customer_count, caa_cna_customer_count, total_found_devices, caa_found_devices, cna_found_devices, findit_found_devices | rename customer_count as "Total Customer Count", caa_customer_count as "CAA Customer Count", cna_customer_count as "CNA Customer Count", caa_cna_customer_count as "CAA and CNA Customer Count", total_found_devices as "Total Found Devices", caa_found_devices as "CAA Found Devices", cna_found_devices as "CNA Found Devices", findit_found_devices as "FindIt Found Devices" | transpose | rename column as "Basic Information", "row 1" as "1 day ago"] | join[search index=caabistats **| sort ~_time | head 7 | tail 1** | eval caa_cna_customer_count=(caa_customer_count+cna_customer_count)-customer_count | table customer_count, caa_customer_count, cna_customer_count, caa_cna_customer_count, total_found_devices, caa_found_devices, cna_found_devices, findit_found_devices | rename customer_count as "Total Customer Count", caa_customer_count as "CAA Customer Count", cna_customer_count as "CNA Customer Count", caa_cna_customer_count as "CAA and CNA Customer Count", total_found_devices as "Total Found Devices", caa_found_devices as "CAA Found Devices", cna_found_devices as "CNA Found Devices", findit_found_devices as "FindIt Found Devices" | transpose | rename column as "Basic Information", "row 1" as "7 days ago"] I did figure out a workaround and it is listed here: index=caabistats | sort ~_time | head 1 | eval caa_cna_customer_count=(caa_customer_count+cna_customer_count)-customer_count | table customer_count, caa_customer_count, cna_customer_count, caa_cna_customer_count, total_found_devices, caa_found_devices, cna_found_devices, findit_found_devices | rename customer_count as "Total Customer Count", caa_customer_count as "CAA Customer Count", cna_customer_count as "CNA Customer Count", caa_cna_customer_count as "CAA and CNA Customer Count", total_found_devices as "Total Found Devices", caa_found_devices as "CAA Found Devices", cna_found_devices as "CNA Found Devices", findit_found_devices as "FindIt Found Devices" | transpose | rename column as "Basic Information", "row 1" as Current | join[search index=caabistats **earliest=-1d@d latest=-1d@d+1d** | eval caa_cna_customer_count=(caa_customer_count+cna_customer_count)-customer_count | table customer_count, caa_customer_count, cna_customer_count, caa_cna_customer_count, total_found_devices, caa_found_devices, cna_found_devices, findit_found_devices | rename customer_count as "Total Customer Count", caa_customer_count as "CAA Customer Count", cna_customer_count as "CNA Customer Count", caa_cna_customer_count as "CAA and CNA Customer Count", total_found_devices as "Total Found Devices", caa_found_devices as "CAA Found Devices", cna_found_devices as "CNA Found Devices", findit_found_devices as "FindIt Found Devices" | transpose | rename column as "Basic Information", "row 1" as "1 day ago"] | join[search index=caabistats **earliest=-7d@d latest=-7d@d+1d** | eval caa_cna_customer_count=(caa_customer_count+cna_customer_count)-customer_count | table customer_count, caa_customer_count, cna_customer_count, caa_cna_customer_count, total_found_devices, caa_found_devices, cna_found_devices, findit_found_devices | rename customer_count as "Total Customer Count", caa_customer_count as "CAA Customer Count", cna_customer_count as "CNA Customer Count", caa_cna_customer_count as "CAA and CNA Customer Count", total_found_devices as "Total Found Devices", caa_found_devices as "CAA Found Devices", cna_found_devices as "CNA Found Devices", findit_found_devices as "FindIt Found Devices" | transpose | rename column as "Basic Information", "row 1" as "7 days ago"] Looks like there might be some problem or bug in Splunk 6.1 when using sort ~ time | head x | tail 1 ... View more