Your "table" must come with a sequence or the whole problem is unsolvable.  The sequence may come in the form of a _time field, or a special field such as sequence_number, or in the form of sheer order of the table. The whole point is, you can use transaction command to get what you need if your table Has a _time field and Is in reverse time order. | transaction "change #" "user ID" startswith="Mod_type=OLD" endswith="Mod_type=NEW" If, for any reason, your "table" doesn't come with a _time field, you can always make sure it is in reverse time order, and make up a _time field.  You can also use stats to do the same.  The bottom line is: join is seldom the answer. Here is a data emulation for you to play with and compare with real data. | makeresults format=csv data="Mod_type, user ID,Email,change #,Active NEW,123,Me@hotmail.com,152,Yes OLD,123,Me@hotmail.com,152,No" | eval _time = now() ... View more