Have you tried using a transaction search to group events that occurred at the same time? This would be more flexible than using the exact time as you seem be trying with your date_time field in your join because it doesn't have to be an exact match. You could use maxspan=5s witch would group events that occur within a 5 second window. source=src | transaction maxspan=5s | search emp_id=23 The real problem here is that your log doesn't provide any kind of unique correlation id that lets your accurately group your events together so you have to come up with some alternate (and less accurate) way to group your events. Another approach would be to tell splunk where your events start and stop. This works if your events are always a "Sent" event followed bya "Received" event and there aren't ever intermixed. If this is the case, you could try a search like this: source=src | transaction starswith="Sent" endswith="Received" | search emp_id=23 Hope that gives you some ideas to try. ... View more