A much better search would avoid the use of transaction and instead do: sourcetype=access_combined earliest=-5m | stats distinct_count(user_agent) as ip_agent_count by clientip | where ip_agent_count >= 20 Your first query is much better written as: sourcetype=access_combined earliest=5m | stats count by clientip | where count > 500 In general, the stats searches will scale about linearly with the number of indexers in your indexing cluster, while transaction does not map-reduce as well and so will bottleneck on the search head. ... View more