index=* App=appA OR appB OR appC |
stats sum(Rate) as appSumRate by _time, App |
appendcols [ search index=* App=appD |
stats sum(Rate) as appDsumRate by _time, App ]
When I try the above search I only get a fraction of the subsearch results, no matter what timerange.
When I do the appendcols subsearch by itself, it gets the full timerange.
What can I do to increase the range?
... View more