Search for results which don't appear in subsearch

[smcdonald20]

I have the below search, but am not getting any results (even though I know there are results).
There are over 10,000 results in the first query, could that be the issues?

index=ad source=otl_aduserscan
|fields samAccountName, enabled
|search NOT [search index=summary source="otl - engineering - jira au tickets"
|fields Username | rename Username as samAccountName ]
|table samAccountName

[lguinn2]

I would try it this way:

(index=ad source=otl_aduserscan) OR (index=summary source="otl - engineering - jira au tickets" )
| eval samAccountName=coalesce(samAccountName,Username)
| chart count by samAccountName index
| fillnull
| where summary=0
| table samAccountName

This solution avoids any subsearch limitations (time or size of results). It may also be much faster. Finally, you can easily debug this search by running just the first 2-3 lines to "see what you get."

[somesoni2]

If your subsearch result is getting truncated, you should see additional data since you're using NOT command (less records subsearch returns, less records will get filtered). Does the value of field Username in your summary index and value of field samAccountName match exactly? Give this a try as well.

index=ad source=otl_aduserscan
|fields samAccountName, enabled
|search NOT [search index=summary source="otl - engineering - jira au tickets" 
|stats count by Username | eval samAccountName="*".Username."*" | table sasmAccountName ]
|table samAccountName

[niketn]

Not sure if the query will be any better

index=ad source=otl_aduserscan NOT 
  [ search index=summary source="otl - engineering - jira au tickets" 
   | dedup Username 
   | eval samAccountName=Username ]
| table samAccountName