Ho @nicolocervo , use ko in ad the last Solution because it’s very slow and resource expensive. in your case, if you have less that 10,000 rose, I hint to use a lookup. you fon’t news a kvstore because you have to drop and recreate the lookup every night the other choice you shock explore are DataModels:in fee words a db table containing al the data or also a Summary index scheduling a Search from your index to have every day the data. then use stata instead join to join data you can find many samples of this approach in my other ansierà. if you could share a sample of your seatch I could guide you in this approach index=my_events OR (index=imported_data source=src earliest=-24h) | stats values(field1) AS field1 values(field2) AS field2 dc(index) AS dc_index values(index) AS index BY common_field | where dc_index=2 Ciao Giuseppe
... View more