The inability to apply set operations on values of fields means that this correlation search isn't nearly as powerful as it could be. See here for more information: http://answers.splunk.com/answers/258504/how-to-count-the-the-number-of-elements-in-a-field.html