Neither "join" nor "appendcols" work correctly if there are times* that contain an event of the first type but not of the other type. If using "join", those times will be completely skipped. If using "appendcols", because the columns get filled in with no gaps, some of the data can get shifted into the wrong time zone. Using eval seems to work correctly. *Or time periods, if you're using "|bin _time" ... View more