you might run into problems since your are using indexes like data bases, it seems. Each event in an index will be assigned a timestamp (field _time). In your context this might be one of the fields, it might be something different. This might make your use case hard to handle, since your have to do a alltime search in order to catch every event on each side for your join. Moreover, you use dedup ... which is costly on large data sets.
Is there a way you can "transform" your use case into a timely context? Like looking just on data from last week? This of course will only work if you have a meaningful _time field.