Hi Giuseppe, I like the way of doing that without join. i´ve notice that joins are terrible slow. The problem with the example is that it give data that I don´t need. I mean eventtype 000111 is an event which occurs very few times in a week, meanwhile event 123 occurs permanently. both events, 000111 and 123 have the srcip field, but just the event 123 have the hostname field, so I need to having found an unique 000111 event, look for a 123 event which has the same ip address on the same time (around 10 minutes) to take its hostname.  On the query suggested I´m getting ip and hostname for every event which has an 123 event. but they don´t have an 000111 event.   Thanks ... View more