Our saved-search is summary-index enabled and is running every 5 minutes.
Each event's uniqueness is a combination of 4 fields and thus I'm planning to add a unique identifier before it gets written to the summary-index e.g. | eval uniqueId = sha256(field1 . field2 . field3 . field4).
One of our use cases is to left-join values from the aforementioned summary index to a lookup table, which already has the same field i.e. uniqueId. The idea is to join the summary index and the lookup table like our good old SQL baby ON uniqueId=uniqueId.
My question is how much computing power will it cost for the saved search to perform the hash? Will it significantly slow down the summary indexing process?
Is it better to do | join type=left field1, field2, field3, field4 rather than | join type=left uniqueId?