I think I more or less had this right before, but was tripped up by the default maxsearches default to map which was truncating my results. However, this seems like further evidence I'm doing this wrong, as getting the results requires nearly 10,000 searches.
Here's what I have:
| tstats dc(All_Application_Events.user_email) AS "report_viewers"
FROM datamodel=Application_User_Events
WHERE nodename=All_Application_Events.Authenticated_Events.Report_Views
BY All_Application_Events.account_subdomain, _time span=1w
| eval earliest_time=relative_time(_time,"-30d"), latest_time=relative_time(_time,"-1d")
| rename All_Application_Events.account_subdomain AS account_subdomain
| map maxsearches=100 search="|
tstats dc(id) AS response_count
FROM datamodel=Application_User_Events
WHERE
nodename=All_Application_Events.Capture_Events.Response_Views AND
earliest>=$earliest_time$ AND
latest<=$latest_time$ AND
All_Application_Events.account_subdomain=$account_subdomain$
| eval start_time=$earliest_time$, end_time=$latest_time$, report_viewers=$report_viewers$, account_subdomain=\"$account_subdomain$\"
| fields start_time, end_time, response_count, report_viewers, account_subdomain"
Thanks.
... View more