Try to avoid using join where possible, it has a number of limitations) - and in this case it's possible (index=wineventlog sourcetype=Script:ListeningPorts dest="172.*.*.*" host="Computer1") OR (index=wineventlog sourcetype=WinHostMon host=Computer1) | eval process_id=coalesce(process_id, ProcessId) | stats values(dest) as dest values(Path) as Path values(process) as process by host process_id dest_port The final stats statement will depend on what you want your output to be. This will probably be faster than a join and avoid its limitations ... View more