There are very many ways to add results together in splunk. The word join is only one of them, usually not the right one. Join is useful, assuming that there are specific fields in common and you want the information from the two different search parts moved together into a single record. | append is useful for adding the results of a completely different search onto the end of the results of the current search. For alerts, this is probably what you want. Append has limits, both in terms of time and in terms of number of records that can be returned, but for alerts, you should not approach those limits. | multisearch is useful for running several simultaneous searches, and has no limits on the number of records returned, but has limits on which commands are available. In general, only distributed streaming commands are allowed - commands that can be executed independently on each indexer. Once you get to the first aggregate command, transforming command, and so on, it has to be outside the multisearch structure. At your level, that is not going to get you anything, so you should consider this command a curiosity rather than a tool until you get pretty good at a mixed search (what I call the "splunk soup method"). Plain old mixed search is usually the best practice. There's a pretty good description of what, how and why here. https://answers.splunk.com/answers/562855/extracting-timebased-information-from-multiple-joi-1.html ... View more