dataset="sonicwall_hunt"
| h2_ready="true"
| event_ms >= 1793516400000
| event_ms < 1794072300000
| kind="vpn_success" saml_enabled="true" join_key=* join_key!="" join_key!="-" session_key=* session_key!="" session_key!="-"
| select([@timestamp,join_key,tenant_id,appliance_id,record_id,principal_id,service_id,session_key,event_ms])
| join(query={
    dataset="sonicwall_hunt" h2_ready="true" kind="idp_saml_success"
    | event_ms >= 1793516100000
    | event_ms < 1794072600000
    | select([@timestamp,join_key,event_ms])
    | rhs_idp_ms:=event_ms
  },field=join_key,include=[rhs_idp_ms],mode=left,max=200000,limit=200000,
    start="1793516100000",end="1794072600000")
| case {
    rhs_idp_ms=* rhs_idp_ms!=""
    | delta_ms:=event_ms-rhs_idp_ms
    | case { delta_ms>=-300000 delta_ms<=300000 | idp_hit:=1; * | idp_hit:=0; };
    * | idp_hit:=0;
  }
| groupBy([tenant_id,appliance_id,record_id,principal_id,service_id,session_key,event_ms],function=[max(idp_hit,as=idp_matches)],limit=max)
| idp_matches=0
