Okay well after talking to someone else on my team we figured a way around all this. We're still using join but we don't have any missing entries. It look like this: index=index1 | rex field=_raw "rex_field=xxx(?<rexA>\w+.\w+)%23(?<rexB>\w+)" | dedup rexA rexB | top limit=50 showperc=false rexB | sort count desc | join type=left rexB [search index=index2 source="source1" | table rexA fieldA fieldB... | dedup fieldA] | table fieldA rexB fieldB...count | search fieldA!="" | head 25 | addcoltotals labelfield=fieldA label="Top 25 Total" We also added information from source2 to source1 to simplify things. Thanks for your help everyone! ... View more