Hi @bowesmana , sorry for confusion There is only one index="a" Yes line 4 has no purpose for now, and I want to pick a user from sub query let's say user1 we got at 1:23:20AM  from sub query now I want to look for all the logs in the mentioned main query for user1 within 1:25:20AM. And if I get one then I want it to be listed. And also I want only the users from sub query to be in the list but no other users which it picks up from main query. Please let me know if I was able to explain it  ... View more

I also tried adding this to the below query but it still pickedup more users from the main query. While I only want it to take into account the users I am getting from sub query. |appendcols [ search index="a" eventName="xxx" ***other conditions here** |rename principal{} as User | where firstime > _time | where maxTime < _time | stats count by User] ... View more

@bowesmana , any suggestions here would be great , it's like a loop I am stuck in ... View more

 now this is giving me result but I want it to pickup the user from subquery and only fetch details from main query for time greater than=120 secs, also there would be multiple users ... View more

Thank you for suggesting, it worked ... View more