Appending lookups doesn't work with RT as you say I think. The only thing I think I can suggest is that every 15 minutes you inject the list of all the P_LOGIN_NAMEs into Splunk (you can use a scheduled search and pump it into a summary Index). Then you're RT search would be:
(source="Apache_dealers_pays_logs" status=200 OR status=404) OR (index=my_summary_users_list_index) |
eval P_LOGIN_NAME=coalesce(P_LOGIN_NAME,LOGIN) | eval status=if(isnull(status),"n/a",status) | chart dc(sourcetype) over P_LOGIN_NAME by status
... View more