Hi, I am trying to match events between two index: Index A & Index B. Index A have 3 column: date-time, User's Cell NO, user's account type and the agent name who modify that user's information. Index B have 3 column: date-time, User's Cell NO, user's account type and the agent name who modify that user's information. Both the data is different sources and different values, date-time. My expectation is to match the user's cell no between two index based on below criteria: 1)_ If any "cell no" exist in "Index A" will match with "Index B" only 10min before of the Index A time. I tried below command which is not as expected result:_ index=A | join CellNO type=outer usetime=true earlier=true [search index=B earliest=-10m latest=now | fields _time,CellNo,Agent,TIME-B] | fillnull value="Not found" | table _time(A),CellNo,TIME-B,Agent 2) If any CellNo exist in Index-A but not exist in Index-B (just 10min before of the Index-A time), then i want to see the "agent name" from Index-A Can anyone please help on this to share the commands. ... View more