A city hunt for hosts that talked to C2 uses a subsearch that returns an entire day's destination IPs and then hits subsearch limits. What should the analyst do instead?

Large subsearches that return an entire day's destination IPs routinely hit result limits and become fragile on city-scale proxy or firewall data. For a hunt of hosts that talked to C2, load indicators as a threat-intel lookup or use a constrained tstats join pattern so the main search matches against a bounded indicator set instead of waiting on a giant dest-IP subsearch. Lookups and tight summary joins scale with municipal traffic; unbounded subsearches do not. Enlarging the subsearch to All Time increases the overflow risk rather than fixing truncation. Putting index=* inside the subsearch does not remove limits and widens cost across every civic index. rex on subsearch results cannot bypass the result cap and does not change the architecture problem. Exam caveat: subsearches remain useful for small, selective sets—the anti-pattern is using them as a bulk IoC transport for a full day of destinations. Operational check: move the C2 indicators into a lookup or a tightly filtered tstats set, rerun the talked-to-C2 hunt, confirm hosts still match without subsearch truncation warnings, and retire the day-wide dest-IP subsearch from the runbook. Document the revised SPL in the civic SOC runbook so the next on-call analyst inherits the efficient pattern rather than the anti-pattern.