I accepted this as the solution because it was the earliest one that mentioned eval with periods/dots for the concatenation which is the most common approach I've seen in the last 12 years since this answer was written. Nice work! I do believe the | strcat works too, but didnt check before writing this.
... View more
Hi,
As per your query understood the events are more than 1000000, check the below links and Hope this helps your query!
https://docs.splunk.com/Documentation/Splunk/7.1.2/Admin/Limitsconf
https://docs.splunk.com/Documentation/Splunk/7.1.2/Admin/Savedsearchesconf#dispatch_search_options
... View more