Hello community! We're really stuck on a question ... Basically we are trying to do ask the following question For users who installed on day X, what % came back on day X+1? 1) We have installs logged sourcetype="smartypants_app" action="remote_auth" install=true | timechart span=1day values(user) as user dc(user) as installs 2) We have logins sourcetype="smartypants_app" action="remote_auth" | timechart span=1day values(user) as user dc(user) as logins If this was SQL we would do something like SELECT * FROM remote_auth installs, remote_auth logins WHERE installs._time BETWEEN x AND x+1 AND logins._time BETWEEN x+1 AND x+2 AND installs.user = logins.user GROUP BY installs.user Problem: how to do this in Splunk? Many thanks for anyone willing to help! ... View more