The join command can be used to combine the results of two searches - and to restrict the time-ordering. Usually I suggest that people try to combine searches and avoid join, since it can be slow. But for this situation, the join command might be helpful and easier than something like delta . This kind of search might do what you want... index=antivirus "malware event" | join host usetime=T earlier=F [ search index=proxy "blocked event" | stats count earliest(_time) as _time by host | where count > 100 ] ... View more