Hi,  I am trying to get all events with two different kinds of objectname(A or B vs C) but with the same username and their access time should be close.  The accessTime of events with Objectname C should be happen just after the events with  Objectname A or B.  Here is my current query: index=index1 host=host1 ObjectName=A OR ObjectName=B |rename accessTime AS accTime1 | eval ptime=strptime(accTime1,"%Y-%m-%d %H:%M:%S") | join userName [ search index=index1 ObjectName=C | rename accessTime AS accTime2 | eval itime=strptime(accTime2,"%Y-%m-%d %H:%M:%S") ] | eval diff=abs(ptime-itime)/60 |appendpipe [|search diff<2] | timechart span=1day dc(userName) is there any way can help me optimize this query since when the search time window become to be 1 months or more, the subsearch limitations will influence the search result. Thanks! ... View more