https://community.splunk.com/t5/Getting-Data-In/How-to-join-match-on-closest-time/m-p/635477#M108730 <P>Hi,</P> <P>After some advice please.&nbsp; I am using a left join with Max=0 as need to find some events over a 24 hour period, however a user may have more than one event in the subsearch but i need to match on the closest time to my main search.</P> <P>Not sure what's the best approach to make that match?</P> <P>Lee</P> Wed, 22 Mar 2023 15:41:47 GMT finchy 2023-03-22T15:41:47Z https://community.splunk.com/t5/Getting-Data-In/How-to-join-match-on-closest-time/m-p/635477#M108730 <P>Hi,</P> <P>After some advice please.&nbsp; I am using a left join with Max=0 as need to find some events over a 24 hour period, however a user may have more than one event in the subsearch but i need to match on the closest time to my main search.</P> <P>Not sure what's the best approach to make that match?</P> <P>Lee</P> Wed, 22 Mar 2023 15:41:47 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-join-match-on-closest-time/m-p/635477#M108730 finchy 2023-03-22T15:41:47Z https://community.splunk.com/t5/Getting-Data-In/How-to-join-match-on-closest-time/m-p/635482#M108731 <P>This is a rather generic question - as a generic answer, the best approach is to avoid using join if you can.</P> Wed, 22 Mar 2023 09:53:44 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-join-match-on-closest-time/m-p/635482#M108731 ITWhisperer 2023-03-22T09:53:44Z