From the fact that you're talking about outer joins, you are coming from an SQL background, so READ THIS FIRST: https://answers.splunk.com/answers/561130/how-to-join-two-tables-where-the-key-is-named-diff.html The general answer is called "splunk soup" or "splunk stew". You throw all the records and fields you want together in the pot and then stir until they come apart the way you want. Here's generic pseudocode for that method... ((filters identifying events of type A) OR (filters identifying events of type B)) | fields ... the list of every field that you need from either type A or B... | eval joinfield = case(expression to detect type A, functions(to(transform(events, of, type, A))), expression to detect type B, functions(to(transform(events, of, type, A)))) | stats values(field1) as field1 values(... as fieldN by joinfield Then you can also look at this one. If you still have any questions, then please feel free to ask via a comment here. https://answers.splunk.com/answers/816615/how-to-search-for-a-value-in-multiple-fields.html ... View more