index=sonicwall_hunt earliest=0 latest=now
| where event_ms >= 1793516400000 AND event_ms < 1794072300000
| search h2_ready="true" kind="vpn_success" saml_enabled="true"
| where isnotnull(join_key) AND join_key!="" AND join_key!="-" AND isnotnull(session_key) AND session_key!="" AND session_key!="-"
| fields join_key tenant_id appliance_id record_id principal_id service_id session_key event_ms
| join type=left max=0 join_key [
    index=sonicwall_hunt earliest=0 latest=now
    | where event_ms >= 1793516100000 AND event_ms < 1794072600000
    | search h2_ready="true" kind="idp_saml_success"
    | fields join_key event_ms
    | rename event_ms AS rhs_idp_ms
    | fields join_key rhs_idp_ms
  ]
| eval idp_hit=if(isnotnull(rhs_idp_ms) AND rhs_idp_ms>=event_ms-300000 AND rhs_idp_ms<=event_ms+300000,1,0)
| stats max(idp_hit) AS idp_matches BY tenant_id appliance_id record_id principal_id service_id session_key event_ms
| where idp_matches=0
