Hi @bowesmana yes I see where I was wrong. It works perfectly now, thanks so much 😊 ... View more

In principle, things seem ok, but you are using many joins, so one possibility is that your data set size is complicating things. joins are not really the Splunk way of doing things and you can generally achieve the same outcome using stats. join will have limitations, particularly with the data size of the join set. Also subsearches have a limited run time. Given that you have 10 joins, it could be related to that. How long does the search take to run? If you shorten the range of the 3rd and 4th time, to a few seconds, but still -1d does that change the result?   ... View more