TLDR:  Goal is to perform an initial search which returns table of time user authenticated, then for each row in the table performs a subsequent search to find each time they established a connection to server.  The Authentication data and Network data are 100% separate.    My initial search is index=authentication objectId="thingIcareabout"  | eval earliest1=timestamp/1000 | eval earliestPlus10m=earliest1+600 | table username, earliest1, earliestPlus10m This successfully runs and returns: username earliest1 earliestPlus10m Joe 1610632992 1610630191 Bob 1610629591 1610633592   Reason why I add earliestPlus10m is so I can run a subsequent search against the network index and limit the amount of results to parse.  If I try the map command index=authentication objectId="thingIcareabout"  | eval earliest1=timestamp/1000 | eval earliestPlus10m=earliest1+600 | table username, earliest1, earliestPlus10m | map search="index=network connected $username$ earliest=$earliest1$ latest=$earliestPlus10m$ | stats earliest(_time)"  I get my 2 events, but no results in Statistics from map. I run job inspector  say the map returns no results.  I literally copy the query from inspector and run it in a new search and it does return exactly what I want.  For instance index=network connected Joe earliest=1610632992 latest=1610632992 | stats earliest(_time) does return correctly.  Confused here what I may be doing wrong...   My ultimate goal is userName earliest1 subsearch(time) calculated field (subsearchtime-earliest10 Joe 1610632992 1610633001 9 Bob 1610629591 1610629598 7 ... View more