@saboobaker - I gave you all those because this structure is extremely inefficient. I don't see any issues with the theory, though.
First, put white space between the source[ just in case the subsearch does not return a starting space. If that works, you are done.
Second, check to see whether you are running out of time or space. That should not be the case, since the subsearch is only returning two fields. Nonetheless, it is a theoretical possibility. Look at the job inspector and look for language about the job being complete or incomplete, and how many events were scanned and how many returned. If that looks normal, then check the search log to see what happened there.
... View more