Hi,  I am working on a search that looks for instances of "string1", but only those that are not followed by instances of "string2" in X minutes of time. The search runs once every 24hrs and should produce a total count of the instances found. I am trying to search with bin command. | index=x | search "string1" NOT "string2" | bin _time span=5min The problem is that this search looks for 5min in the past, as well as 5min in the future. So if "string2" is present within -5min from "string1",  that instance does not get counted, and it should be. It should only be excluded if "string2" is after  "string1". Many Thanks ... View more