Do you have to use multisearch here?  This simple search seems to accomplish what you desired: index IN (ABC, DEF) status.code>399 | eval StatusCode = COALESCE(status.code, data.status) | chart count over StatusCode by index | addtotals   ... View more

If you have outbound mail setup you can use |sendmail after the outputlookup. This this works for me, and Im able to receive csv files attached that were produced by the outputlookup: mysearch | outputlookup mylookup.csv | sendmail to="abc@xyz.com" sendcsv=true See these docs: https://docs.splunk.com/Documentation/Splunk/9.0.1/SearchReference/Sendemail https://docs.splunk.com/Documentation/SplunkCloud/latest/SearchReference/Sendemail   ... View more

Yes I think you're right. Using regex seems to be about as fast as doing something similar with the 'search' command or the 'where' command. I was confused about what order things should be done in for optimization. I also found the info on Parallel processing on this page useful. Thanks for your input.  ... View more