Converting the search to an actual sub-search made all the difference in performance for this query
sourcetype="beacon-spans" requestSpan.stack="prod" [search sourcetype="alm-spans" userId=marc | dedup requestSpan.traceId | table requestSpan.traceId]
The only negative to this query is that it does not return the values for subscriptionId and userId like the original join query did. I was able to work around this with a lookup after several other summary steps.
I really appreciate the help from sideview, cramasta and ayn
... View more