Like this: index=YourIndexHere sourcetype=YourSourcetypeHere field1 = "1" field2 = "20" (field3 = "am" OR field3 = "pm") | stats dc(field3) AS numSources values(*) AS * BY field4 You now have a fully joined set: For left Join, add this: | search field3="am" AND numSources>1 For right join, add this: | search field3="pm" AND numSources>1 For inner join, add this: | search numSources>1 For outer join, add this: | search numSources=1 ... View more