I'd rather use streamstats like this: <yourbasesearch> | streamstats count range(_time) as range window=5 | where range <= 3600 AND count = 5 This will discard the first four results due to not having seen five yet, and after that keep every row where the four previous events are within an hour from it. The reason for not using transaction, apart from speed, is that it may actually fail. Consider this: ...long silence... event n: 12:00 event n+1: 12:45 event n+2: 12:55 event n+3: 13:05 event n+4: 13:15 event n+5: 13:25 Events n+1 to n+5 would satisfy the condition and should be found, but I'd think that transaction would group the events n to n+2 into one transaction, then go to the next transaction due to exceeding a span of one hour so you should get two transactions with three events each. ... View more