Hi this is exactly like @bowesmana said. You should have transforming search in you base search. I think that you could fix this by something like this <search id="BaseSearch">
<query>index=myOnlyIndex
| bin span=1h _time
| stats count by _time failureCode clientApp environment protocol reqMethods
</query>
<earliest>$time_token.earliest$</earliest>
<latest>$time_token.latest$</latest>
</search> Then I think that your post-process search could work like it's now. You just need to ensure that base search don't return more than 500k events and it's don't take longer than 60s. r. Ismo
... View more