I have a case where I have several lookup tables which I want to join on the same key. I use append to make the union of all the events, then use | stats values(*) as * by key to combine them back to a single event per key, with the union of all the lookup values. For my data volume, this works well.
| inputlookup file1.csv where condition
| append [ | inputlookup file2.csv where condition]
| append [ | inputlookup file3.csv where condition]
| stats values(*) as * by key
... View more