Oh yeah, that is a problem - it should say "by EmailID". but on further consideration, I would probably do this for the second query: index=prod-web-apps sourcetype=csv-emailevents (EventName=delivered OR EventName=processed) | stats count latest(EventName) as DeliveredEventName earliest(EventName) as ProcessedEventName latest(DateIndexed) as DeliveredDateIndexed earliest(DateIndexed) as ProcessedDateIndexed range(DateIndexed) as TimeInSendGrid by EmailID | where count=2 This should be faster and more accurate, as it simply assumes that the "processed" events will occur at an earlier time than the "delivered" events. ... View more