You may be getting events arriving later into the instance, what could explain the variation in numbers you;re seeing Check the _indextime field in those events to verify that ... View more

yeup. This works for me. ... View more

The problem was with [| search index=entity_sum_1_2_ key=tcds_1_2_entity_feed | search [|inputlookup customer.csv | search [| search index="entitydata_1_2_" kpr=RKT_Call_Finished | rename source as Source | return Source] | rename Customer as customer | return customer]| rename entityName as name |fields entNum , name,tfdid,entityID] I changed this up [| search index=entity_sum_1_2_ key=tcds_1_2_entity_feed [| search index="entitydata_1_2_" kpr=RKT_Call_Finished | top 1 source | table source | join type=left source [|inputlookup customer.csv | rename Source as source | table source, Customer] | table source, Customer | rename Customer as customer | return customer] | fields entNum, name,tfdid, entityID] I could obsorve having multiple return statements was slowing it down considerably and since I was planing to return only one value of source, I used top 1. This helped get speed up the execution and work as expected. I still suspect if this is a permanent fix for this problem. ... View more

I got it working.. Created a saved search for the db_lookup as shown below. |dbquery $schema_name$ "SELECT name, duration FROM tab1" save this search as as db_lookup_test Create a new Saved Search will pass in the parameter schema_name as shown below : | savedsearch db_lookup_test [|inputlookup customer.csv |eval schema_name=db_info | return schema_name] ... View more

@rmuraly, I have converted my comment as answer. Please accept to mark the question as answered. ... View more

Hi rmuraly, You should avoid sub searches, because they are slow and will hit limits as soon as you put real data volumes through them. Try a simple conditional eval on this: index="test" OR index="test_summary" | eval y_time=if(index="test_summary" AND key_field="y", _time, 0) | stats max(y_time) AS y_time max(_time) as _time by _time (add any other fields needed further down the pipe ...) | where _time > y_time | do more splunk-fu here .... This may or may not provide a solution to you, but it for sure shows a way to go. You can read more on this topic in this answer https://answers.splunk.com/answers/129424/how-to-compare-fields-over-multiple-sourcetypes-without-join-append-or-use-of-subsearches.html or in the March session of the Virtual .conf here http://wiki.splunk.com/Virtual_.conf Hope this helps ... cheers, MuS ... View more