@numeroinconnu12 follow these steps convert the timestamps into epoch, eval DateMin=strptime(DateMin, "%Y-%m-%d %H:%M:%S") difference between the two epoch times will be in seconds, eval Diff=(DateMax-DateMin) convert the difference to min, eval Diff=round(Diff/60,2) add a filter using where command, where Diff > 6 adding all the above steps together eval DateMin=strptime(DateMin, "%Y-%m-%d %H:%M:%S"), DateMax=strptime(DateMax, "%Y-%m-%d %H:%M:%S") | eval Diff=round((DateMax-DateMin)/60,2) | where Diff > 6 you can merge them to a single eval. But I though this will give you good clarity. Hope this helps
... View more