I have a base search to collect all data and some subsearches that access these base searches to draw graphs. Base search: index = app sourcetype = airchangeservice "LogName=com.expedia.www.platform.diagnostics.tracing.TraceResources" | rex "(?{[^}]+})" | mvexpand json_field | spath input=json_field | search (eventName="AIR_CANCEL_SERVICE" OR eventName="AIR_VOID_SERVICE") | fields eventName, context.STATUS, context.TPID The subsearches draw graphs for different eventName, context.STATUS, context.TPID. See one of my subsearches: <query>| search ("PROVIDER CODE":"TF") OR ("PROVIDER_CODE":"TF") AND eventName="AIR_CANCEL_SERVICE"| timechart span=1d count by context.STATUS</query> </search> Is there anything I can do to optimize the searches? ... View more