Scheduled Searches: Subquery optimization

Author: amee-sumo

blog-service/2025-07-28-alerts.md

@@ -0,0 +1,26 @@
+---
+title: Time range limits for subqueries in Scheduled Searches (Alerts)
+image: https://help.sumologic.com/img/reuse/rss-image.jpg
+keywords:
+  - alerts
+  - scheduled searches
+  - subqueries
+hide_table_of_contents: true    
+---
+
+To help you optimize query execution and improve data retrieval efficiency, we’ve introduced time range limits for sub-queries in scheduled searches.
+
+These enhancements:
+- Improve query performance and responsiveness.
+- Encourage efficient search practices.
+- Support sustainable resource usage.
+
+**Who benefits**
+Data analysts, IT operations, and security engineers seeking faster, more efficient investigations without compromising functionality.
+
+**Why it matters**
+Inefficient long-term queries cost millions in compute resources and delay resolution times. This update keeps our platform high-performing and cost-effective, without sacrificing power or usability.
+
+This change helps prevent long-running, inefficient queries, especially those impacting system stability and driving up costs. While maintaining flexibility, these optimizations protect system health and reduce operational overhead.
+
+[Learn more](/docs/alerts/scheduled-searches/schedule-search/#step-3-time-range).

docs/alerts/scheduled-searches/schedule-search.md

@@ -44,6 +44,10 @@ The [time range](../../search/get-started-with-search/search-basics/time-range-e
 This setting is different than the Time Range option configured for the Saved Search. The first time range is only used when you run the Saved Search from the Library. This Time Range applies to your Scheduled Search.
 :::
 
+:::note
+The time range limitations below applies to both parent queries and sub-queries in your scheduled search.
+:::
+
 Alternately, type a time range; for example, -15m to run the search against data generated in the past 15 minutes. A time range outside the maximum allowed range for a given frequency is not allowed and presents the message like this: `Invalid query. Max allowed time range for 15 minutes frequency is 1 day`.
 
 The maximum allowed time range for different Scheduled Search frequencies is as below: