The search now works, and by raising maxsearches, I get all the results. However, the search performs very badly (As expected..). Automatic logout occurs very often, hence the mapped search will run many times. Is there any other way? Piping to search, using a sub search or maybe using the stats command? I have tried a subsearch, but can't make changing time of the parent search work. And I guess sub search will be slow as well. Thanks for any assistance? ... View more

Hi There! I made it work using the coalesque command. That was actually causing the whole problem. Using the where isnotnull command strips away unwanted transactions. I would like to use stats, but would that work when not all the fields are present in all the events? ... View more

Smart mode ... View more

Here is the best way to test out what subsearches do; look at the results of these searches: index=klpi 2345678910 | format index=klpi sessionIndex=2345678910 | format index=klpi sessionIndex sourcetype="fedag:debug" | rex("sessionIndex=(?<sessionIndex>.+)") | eval earliest=_time-1000 | eval latest=_time+1000 | format "(" "(" " " ")" "OR" ")" | rename sessionIndex as search | format Each should result in a single field called search that is the string that will be appended to your outer search. It is unclear to me what you are trying to do but this does explicitly answer your question. ... View more

Actually, I wanted to narrow to 1 second, but startet with 60 to be sure not to miss any while adjusting the search. ... View more

Works like a charm! Thanks a bunch ... View more