I got it working with something like: ("A" OR "B") randomField=*X* | join [search randomField=*X* ("A" OR "B" OR "C" OR "D") | dedup randomField] table randomField _time ... View more