Yes, SPL has a join command, but it should be avoided because it doesn't perform well. See https://docs.splunk.com/Documentation/Splunk/9.2.1/SearchReference/Join
Thanks for your answer. I'm not sure if this is what I want. Because the advanced hunting app requires an API call with a limit of calls, I start doing a call on DeviceProcessEvents. Then I'm not sure if I need to do another API call on DeviceRegistryEvents, since I'd like to joint these two instances.
So basically I'd like to do concatenation between DeviceProcess and DeviceRegistry events in advanced hunting query | advhunt