Hi, I was wondering how harmful is it to get near that limit in a single search query? If some of my searches take more than a few minutes to return, should I be questioning the way I built them? By the way I am already using summary indexes and jobs in other places. ... View more

Hi, is it possible to manipulate the events of a query with a transaction after using stats/table/eval/where? the events are kept no matter what I do to them in the query, maybe they reduce in numbers but the remaining results are the important ones for a possible transaction. For example: source="thesource" A="enterEvent" | stats first(_time) as firstime last(_time) as lastime by userId | table firstime lastime userId | eval time_difference=(lastime-firstime)/3600 | where diff>"12" | transaction userId | table _time userId (obviously I don't have _time anymore in my results, but can't I reuse it from the remaining events?) ... View more

Hi, I'm trying to create a report that does the same search for two different dates, the regular search uses a transaction: (sourcetype="bi_log" "join room success") OR (source="analyticsreport" eventDescription concurrentUsers>0) | transaction eventId | stats dc(userId) as "Visitors" count(sessionId) as "Visits" dc(roomId) as "Total rooms" by eventDescription For the current report I want to run it for today and 24h X DAYS AGO. The finale report I will categorize by eventDescription as before but also by "day" I tried several different times with no success, here is one of them: (sourcetype="bi_log" "join room success" | append [search sourcetype="bi_log" "join room success" earliest="-5d@d" latest="-4d@d"] | convert timeformat="%m/%d/%y" ctime(_time) as "new_t") OR (source="analyticsreport" eventDescription concurrentUsers>0 | append [search source="analyticsreport" eventDescription concurrentUsers>0 earliest="-5d@d" latest="-4d@d"] | convert timeformat="%m/%d/%y" ctime(_time) as "new_t") | transaction eventId | stats dc(userId) as "Visitors" count(sessionId) as "Visits" dc(roomId) as "Total rooms" by eventDescription,new_t I'll appreciate if any of you has suggestions, thanks!! ... View more