To prevent a subsearch from being too expensive, (or, in other words, requiring perhaps unreasonable time or resources to complete) it is limited by a time and event count:
- The default time limit for the subsearch to complete is 60 seconds. If the subsearch is still running at that point, it is finalized and only the events located up to that point are added to the outer search.
- Likewise, the default event limit for the subsearch is 10,000. After this point, any further events will be truncated. If either of these limits is reached, there is probably a better way to accomplish the task at hand.
Another consideration is that the fields returned from the subsearch must be searchable. There is a magical field called search that will be added to the query as a raw search term, but you have to do a little more work. See search context later in this chapter for an example.