Yes it is a dashboard search that is just opened in search so we are 100% sure of the match query and time frame. No errors occur besides the lack of results from one of the indexes ... View more

I understand now, So changing the join type to left, outer, or inner did not make any improvements. I have also confirmed the signature_id match by copying one from the csv and adding it directly to the query. Let me explain what I am trying to do because I am also open to other ways to get it done. I need to produce a dashboard that will show a signature, who it is assigned too, any notes on the event, and when it was first seen. I also need a count of how many Hosts in our current environment have it. Lines 1,2,3 7-10 complete the first task without a problem. It is when I introduce the subsearch that is supposed to tell me how many hosts currently have the issue is where we run into problems. I run the primary search for 100 days because I need to know if it is older than 90 days since the first time that signature was seen. I run the sub search at 4 days because that will capture what is required to see what hosts are currently affected. ... View more

BTW, thanks for the karma points! In the future, if you want to give someone karma points without subtracting from your own pool, you can click to upvote an answer/comment. That way, your karma pool isn't reduced. ... View more

The first query solves it for me. You are correct I will change it but the stats count killing all my fields was my issue. Thank you very much for the help! ... View more