http://wiki.splunk.com/Community:UseSplunkForEventCorrelation might help and/or consider using stats. You might be able to improve on this with a single stats command, but at least this should work and give you the ability to specify different time ranges per index: index=logins | stats max(_time) as lt by account | join account [ search index=door_time | stats min(_time) as ft by account | fields + ft account] | eval duration = lt-ft | table duration lt ft account Assumes that 'account' is your user name that matches in both indexes. ...Laurie:{) ... View more