You are correct, I have adjusted my answer to reflect the more correct nuance. ... View more

Referencing similar post that I think may apply. The only configuration that I know of that can be used in simple xml is a lookup or kv store. http://answers.splunk.com/answers/221617/retrieving-values-from-config-file.html "I personally would use a lookup table to achieve this. Place this data into a csv and import as a lookup file, create a lookup definition for it then if you like create an automatic lookup so you never need to do it again." kv store: http://dev.splunk.com/view/webframework-features/SP-CAAAEZK ... View more

You can probably get away without join by using append-stats (this will perform better as well. Try something like this:- index=companyindex | customparser | dedup shost, status |table _time shost status| append [search Event_desc = Heartbeat | stats max(_time) as LastHeartbeat by hostfieldForthisSearch | rename hostfieldForthisSearch as shost | table shost,LastHeartbeat ] | stats values(*) as * by shost | table _time, shost, status, LastHeartbeat ... View more