SPLUNK QUERY RUNNING VERY SLOWLY -6HRS

[HenryFitzerald]

Hi ,

Could anyone please assist me in this query. It’s running very slowly 6hrs in one case; query does a join on the host when I remove table lookups its much faster but it could be the join sequence.

index=tech_global_raw sourcetype=tech_fcp "Success "
| join host [ search index=tech_global_raw Organization=tf earliest=-15h | dedup host |

table host]
| rex field=_raw "tf[a-z].[a-z]+.(?[^ ]*)"
| lookup tp_map_table tp_service as app_id OUTPUT tp_name tp_feature
| search tp_feature=MSA

| timechart count by app_id

Table tp_map has colums tp_service and tp_feature where in this case tp_feature="MSA" but this is not issue ,it could be how sequence is arranged.Would appreciate any advice on improving query as running very slow.
Thanks in advance,
Henry

[HenryFitzerald]

Missed a feature "app_id" in rex field.

UPDATED QUERY -

index=tech_global_raw sourcetype=tech_fcp

| join host [ search index=tech_global_raw Organization=tf earliest=-15h
| dedup host
| table host]
| rex field=_raw "tf[a-z].[a-z]+.(?[^ ]*)"
| lookup tp_map_table tp_service as app_id OUTPUT tp_name tp_feature
| search tp_feature=MSA
| timechart count by app_id