Nice ref.  Thanks, @bowesmana! (Looks like something since 8.) ... View more

This is a rather generic question - as a generic answer, the best approach is to avoid using join if you can. ... View more

Thanks.  This helps me out ... View more

There's no need to grab lookup files from the indexers since the SH should have the same ones.  Use the splunk_server=local option to suppress the warning. | rest splunk_server=local /servicesNS/-/-/data/lookup-table-files f=title | fields title | dedup title | map maxsearches=1000 search="|inputlookup $title$ | fieldsummary |eval lookup_name=$title$ | fields values field lookup_name " | spath input=values | rename {}.* as *| fields lookup_name field value | search value="text_to_search"   ... View more