Here's an example data in splunk (bookstore logs): time(ms) id stage payload 1020984 aaaa-bbbb-cccc checkout Lord Of The Rings; 1310953 aaaa-bbbb-cccc cart Harry Potter;Game Of Thrones; 1340932 aaaa-bbbb-cccc cart Harry Potter; 1345608 dddd-eeee-ffff cart Splunk for Dummies; 1352093 dddd-eeee-ffff cart Splunk for Dummies;Java 101; 1420838 dddd-eeee-ffff checkout Order#999999999 1450928 aaaa-bbbb-cccc checkout Order #123456789 This shows 2 customers shopping for books and then buying them. The most recent cart row contains what they bought. It also contains a previous checkout from one of the customers. I want to create a query that will return this: time(ms) id stage payload time_spent_browsing 1420838 dddd-eeee-ffff checkout Splunk for Dummies;Java 101; 6485 1450928 aaaa-bbbb-cccc checkout Harry Potter; 29979   The payload field should contain the most recent cart row's payload with matching id The time_spent_browsing field should be the the (most recent cart's time - the earliest cart time). The earliest cart event should be after the previous thank you event. I hope that makes sense. ... View more