It was perfect 😁.  I ended up doing it like this because of how the logs are stored in our environment. index=c account=1 env=lower source="logfiles" ("destination" OR "received") | eval logtype = if(like(_raw, "destination%"),"logb","loga") | rex field=_raw filename in loga| rex field=_raw filename in logb| stats count min(_time) as Starttime max(_time) as Endtime values(logtype) as logtype by filename | where count=2 AND logtype="loga" AND logtype="logb" | eval diff = Endtime - Starttime | stats avg(diff) ... View more