When using <searchPostProcess>, there is one big limitation and there are several smaller limitations that often require a little extra work:
- Only the first 10,000 results are passed from a raw query. To deal with this, it is necessary to run events through stats, timechart, or table. Transforming commands such as stats will reduce the number of rows produced by the initial query, increasing the performance.
- Only specifically referenced fields are passed from the original events. This can be dealt with by using table (as we did in the previous example), or by aggregating results into fewer rows with stats.
The first limitation is the most common item to affect users. The usual solution is to pre-aggregate the ...
