Thanks for your reply. It helped me get to my answer. To address your questions, the macros I included are only left as macros because they have no affect on the outcome. They are just shorthands for the source_type nonsense that precedes a query and the common output fields. The timestamp is just a number, not a time representation at all, so I am just using it verbatim. What finally worked for me was a combination of inputlookup to narrow the search and lookup to get the start_time and end_time values "into" the database. Here is the final query. It returns all transactions that occurred between start_time and end_time on a particular mrch_num/term_num combo where the times are different for each mrch_num,term_num. `search` [|inputlookup template.csv | fields mrch_num,term_num] | lookup template mrch_num ,term_num outputnew start_time,end_time | where j_timestamp>=start_time AND j_timestamp<=end_time | stats count,min(entrytime),max(entrytime) by mrch_num,term_num,acct_num ... View more