Im trying to do this:  aid=0 Overflowexception msg="Print completed" @t<first | [search Overflowexception | stats min(@t) as first by username] which does not work. I want to find the first(min) time the users experiences an overflow, and find if ther has been a completed print before this first overflow. What am I doing wrong ? I can do it manually like this: aid=0 Overflowexception   --to find users that has gotten the error aid=0 Overflowexception username=Staale | sort @t  --to find the first error for user aid=0 username=Staale msg="Print completed" @t<2023-06-29T06:32:53.900387z  --time received from the above But this is very timeconsuming and I want to do it all in one command. I usually uses SQL, so I guess my approach is to SQL like. Any ideas is appreciated. -=Staale= ... View more