Hello, I have a query with multiple subsearches that is slower than I would like, so I am looking for ways to optimize it. The search finds the first event whose path is transaction that occurs after an event whose path is finalize for a given customerId and sessionId . The sessionId is passed in through a dashboard. The first subsearch pulls the customerId out of a cookie using rex . The second gets the timestamp of the finalize event for the relevant session. index=my_index event=response path=*/transactions* [search index=my_index event=response path=*/pair* $sessionId$ | spath output=cookie path=headers.cookie | rex field=cookie "(?<=\bCID=)(?<customerId>.{36})" | return 1 $customerId] | spath ts output=transactionTs | eval finalizeTs=[search index=my_index event=response path=*/finalize* $sessionId$ | spath ts output=t | return 1 $t] | where transactionTs>finalizeTs | tail 1 For all the Splunk pros out there, is there a way to rewrite this query to remove the subsearches, or otherwise improve the performance? ... View more