Suggestion - if you can't create a new summary index, then see if you can do a metadata-only or tstats-style search to meet your host needs. Your goal is "find infected computers" - so you don't necessarily care what exact time in the last 7 days they were infected etc. Assuming that you have indexed fields src_ip and dest_ip, try this - | tstats values(src_ip) as src_ip where index=*Logdata for analysis* AND sourcetype=*Firewall* AND earliest=-7d@d AND latest=-0d@d by dest_ip | join [|inputlookup Dangerous_Ips.csv | rename Dangerous as dest_ip, Dangerous2 as dest_host2] That should be relatively quick in giving you one record per dest_ip that is in Dangerous, with a deduped list of the src_ips that have been associated with that dest_ip in the timeframe under consideration. ... View more