Okay, for Splunk searches, any time you start talking about "first I get THIS information... then I go back and get THIS information..." you probably will end up with a really inefficient search. Instead, you should usually think in terms of "I gather all the events that are like THIS, and then aggregate them THIS way to see whether they meet THESE criteria." In this case, however, I think you can do it the way you said, but you will have to set explicit earliest and latest time modifiers for each part of the search. In this sample, this is coded for finding all password changes in the last fifteen minutes and adding up how many times each of those users changed their passwords in the last 24 hours. We use eventstats for the calculation, so it will add up the information and add it to the event records but retain the entire selected events for review in the case of the users that have index=wineventlog EventCode=4723 status=success user=* earliest=-24h@m latest=@m [ index=wineventlog EventCode=4723 status=success user=* earliest=-15m@m latest=@m|table user] | eventstats count as PwdChanges max(_time) as maxtime by user | where PwdChanges>=3 | sort 0 user - _time ... View more