Hi, I have many lines of event like these two: 2017 12 07 21:32:23.669 | 20,3329788638103|CT02053,15.96x11.81x6.15,211 lbs 2017 12 07 21:29:26.648 | 19,42233978863257|CT02010,16.26x15.43x16.75,4441 lbs Each event starts with a time, then a bunch of random number and code, and ends with the weight in "lbs"(the weight is the number before the "lbs"). I need to accomplish two goals: 1. Count if same weight happens over in 10 events 2. Count those events found from #1 if they are happened within 10 minutes based on their time stamps. I use this query to achieve goal #1. Base search..........| use rex command to create the field for the weight | stats count by weight | where count>10 But I don't know how I can confirm the time of those events are happens within 10 minutes? I tried to add "transaction weight maxspan=10m" at the end of the query but it didn't work. Any idea? Thanks. ... View more