I did a quick and dirty test | makeresults count=10 | streamstats count | eval size=count*10000 | map search="| makeresults count=100000 | streamstats count | search [ | makeresults count=$size$ | streamstats count | tail 1 | table count] " And got 10 results from 10k to 100k. So apparently even though the initial makeresults creates 100k events, the important thing is that the subsearch only returns one result. But if I rephrase the search a bit | makeresults count=10 | streamstats count | eval size=count*10000 | map search="| makeresults count=100000 | streamstats count | search [ | makeresults count=$size$ | streamstats count | table count] | stats count All my results are 10000, because all subsearches are finalized at 10k results.
... View more