I was wondering what the performance was of using a wildcard in a query. Specifically for the following: source="/mnt/logs/*/debug.log" OR a query containing a custom field: uri_path="/v1/*" ... View more

I had a query that was working perfectly until recently where it started cutting off the last 4 days of data just for one grouping for the "Live" category. The odd thing is it only disapeers the results right before the query has completed otherwise it computes the results almost all the way to the end. as query begins: http://cl.ly/image/3a27251m0C0w right before completion: http://cl.ly/image/2j3b360c3C3u here is the query: * search_name="EXEC: New Users By Label (daily) (summary index)" index="summary" | stats count(value_user_device_udid) as new_users by _time, label | streamstats sum(new_users) as total_users by _time,label | eval live=if(total_users >= 100, "Live", "Pending") | stats values(label) as label_values count as daily_count by _time, live | streamstats dc(label_values) as total_apps by live. I've doubled the limits for the following in limits.conf: [searchresults] maxresultrows = 100000 max_stream_window = 30000 [stats] maxresultrows = 100000 ... View more