I'm afraid I still don't understand what you are trying to do. It makes absolutely no sense to join 50000 raw events. In fact, it generally makes zero sense to join raw events to begin with. It is...
See more...
I'm afraid I still don't understand what you are trying to do. It makes absolutely no sense to join 50000 raw events. In fact, it generally makes zero sense to join raw events to begin with. It is best to describe what the end goal is with zero SPL. I posted my four commandments of asking an answerable question many times. Here they are again. Illustrate data input (in raw text, anonymize as needed), whether they are raw events or output from a search that volunteers here do not have to look at. Illustrate the desired output from illustrated data. Explain the logic between illustrated data and desired output without SPL. If you also illustrate attempted SPL, illustrate actual output and compare with desired output, explain why they look different to you if that is not painfully obvious. In your case, simply avoid illustrating SPL. Just illustrate what your data is,characteristics, etc., and what your result look like and why the illustrated data should lead to illustrated result, all without SPL. There is a chance that some volunteers can understand if you do NOT show SPL.