I am currently using the below query...
index=a field1="ABC" | join id [Search index=a AND (field2="B" OR field2="C" field2="D"...)]
But I have 85 distinct values for field2..., so instead of providing too many logical/OR expressions is there a way I can put all these values A, B, C, D ....& Z in a table and write something like...search if field2 is in the table...?
Try something like this
index=a field1="ABC"
| join id [Search index=a [Search index=a | stats count by field2 | return field2]]
The innermost subsearch "[Search index=a | stats count by field2 | return field2]" will return 'OR' separate values to field2 to be used for subsearch.