Subsearches are limited to 50,000 events so if you still want to do it this way, you would have to split your lookup into about 20 different lookups. ... View more

You can't reliably use subsearches as the volumes are too big and you can only join on 50,000 rows. As @aromanauskas suggests, use a index 1 OR index2 approach and combine the two data sets using stats ... by common field.   ... View more

What I missed is running the command "splunk install app -auth :". After doing this it started working. Thanks for your help. 🙂 ... View more