gotcha. yes, i'm working on 'avoiding' join for sure, and thought that stats values(*) thing was here to save me, but it's really intensive, still, too, for this particular data set. for this particular search, i have some set of data in that index i want, which is like 200 rows. so i just created a report for the 200 and sent to a lookup then created a new report and used the other data search and | lookup and while it's substantially faster. that is | stats values(*) as * by id took 1600 seconds and | index="mystuff"
| lookup filename.csv id OUTPUT col1 col2 took about 180s. again, where I 'filtered down' the things i wanted to match by saving them into filename.csv first. i mean, is that a hack? idk. appreciate your wisdom always, sir.
... View more