I have a number of searches structured where I'm comparing again summary indexes and lookup tables or results I don't want. From the docs my searches are formatted like:
index=some_index NOT [search index=another_index | fields field_val]
where the summary index another_index is only updated once a day. These searches are used in my dashboards several times and seem to run very slowly. Is there a way to explicitly save sub search so that it doesn't have to be rerun? Or this done automatically?