The first index contains data from an endpoint security tool that can block outbound/external emails. The second index contains data from another endpoint tool that archives emails (I can see all successful outbound and inbound emails that are not blocked). So essentially, I want to see if user ABC123 gets two email blocks and within 30 minutes of those two blocks (index1), sends a successful email that is not blocked (index2).  ... View more

That is a more precise match to the requirements, but I presumed "thrice" is just as interesting as "twice". If your problem is resolved, then please click the "Accept as Solution" button to help future readers. ... View more