Actually, although you're not typing in the 'search' command into the search UI, it does put on there under the hood.
I think you're comparing apples and oranges -- what you see in the search bar (with no search), to the search that the dashboards kick off, which has a leading search command.
You can verify this by looking at the search that the search UI is kicking off - that'll have a search too even though you didnt put one there.
So it's something else causing the difference.
As far as working around the problem -- I agree with Paolo - I dont see the benefit of using a subsearch here - it'll be more straightforward and it'll run faster if you just do the same processing in the main search.
If letting timechart calculate the top 10 values doesnt work for you, you can make more advanced determinations by using streamstats to put aggregate statistics on the events themselves and then using search or where to compare and filter each event row before it gets to the timechart.
... View more