Hello, I have the search built that generates the results I want. But, the goal is to also be able to track high number of online orders after someone made a retail order. index=data sector=Retail | stats earliest(_time) as firstretailapp latest(_time) as lastretailapp by username | join username [| search index=data sector=Online | stats earliest(_time) as firstonlinesale latest(_time) as lastonlinesale by username] | convert ctime(firstretailsale) ctime(lastretailsale) ctime(firstonlinesale) ctime(lastonlinesale) When these results populate, I can not get the firstonlinesale to be a later date than the lastretailsale. I have tried | eval difference =time1-time2, and where difference >1 and other command searches to try and match up something but am unsuccessful.  Thanks! ... View more