@kcollori - Can you explain how this differs from (or adds requirements to) your use case in this question? https://answers.splunk.com/answers/578302/how-to-join-2-indexes-by-common-field-respective-t.html#answer-579343 When trying to connect something that is non-unique, you have to create uniqueness by a time limit or some other unique characteristic. That generally is going to require streamstats rather than eventstats . You... collect all the events that might be relevant, sort them in order (remember sort 0 so you don't lose any), copy the information you need from one type of record forward or backward onto the other type of record using streamstats , get rid of any records that are now redundant ... occasionally eventstats is useful right here to collect remaining information together ... then calculate and present your information. ... View more

@kcollori - not much difference. As long as you have less than 50K events in the csv, just add inputcsv between lines 1 and 2 of the original search and drop the indexA search from the initial part. Leave the fields command both before and after the inputcsv . (index=B search terms) | fields index customer_id datetime date_of_creation motive | inputcsv append=t usedtobeindexA.csv | fields index customer_id datetime date_of_creation motive remainder of search ... View more