I need to define an outer time range, simple: earliest=-3h I then want to filter the results, also simple: earliest=-3h | stats count(_raw) as count by stuff | where count%2=1 But now the part I am struggling with. I want to define a time range that is even more restrictive: earliest=-3h | stats count(_raw) as count by stuff | where count%2=1 | earliest=-2h This syntax is invalid but hopefully describes what I am trying to achieve. I must have the outer time range, filter and then apply a further time range, is this possible? ... View more