Hello, I would like to update you on this question and propose a solution that I have just setup and tested. since I could not figure out how to update only two columns with the result of a search including a large number of rows, I have decided to split the KV Store into two tables. One with the "fields_list" for the new TicketID's including _key TS and Status (collection = ticket_status), and a second KV Store containing the latest update where I would feed the results from the updating Splunk search (collection = ticket_update_status). These two tables can be included in a search using inputlookup and the duration calculated where required. Here is the new config: collections.conf [ticket_status] [ticket_update_status] transforms.conf [ticket_lookup] external_type = kvstore collection = ticket_status fields_list = _key TS Status [ticket_update_lookup] external_type = kvstore collection = ticket_update_status fields_list = _key TS Status The _new and _mod is now not necessary anymore since we have the two tables separately. This does make the writing of the queries simpler too. To update the ticket_status KV Store table for new created tickets now looks like this: index=test... | eval _key = TicketID | table _key TS Status | outputlookup ticket_lookup append=true And the update with latest status after tickets are modified goes into the ticket_update_lookup KV Store table: index=test... | eval _key = TicketID | table _key TS Status | outputlookup ticket_update_lookup append=true For querying the two tables with lookup and calculate the ticket duration based on the two TS values: | inputlookup ticket_lookup | inputlookup append=t ticket_update_lookup | eval TicketID = _key | stats dc(Status) as check min(TS) as min_ts max(TS) as max_ts by TicketID | eval ticket_duration=(max_ts-min_ts)/60 | where check>1 | table TicketID check ticket_duration ... View more