---
id: timeslice-join
title: Timeslice Join Results
sidebar_label: Timeslice Join Results
description: Use the timeslice operator before the join operator to slice joined data by time period.
slug: /help/docs/search/search-query-language/search-operators/timeslice-join/
canonical: https://www.sumologic.com/help/docs/search/search-query-language/search-operators/timeslice-join/
---

When you gather data using a [`join`](join.md) operator, you can slice data by time period using the [`timeslice`](timeslice.md) operator.

## Syntax

The `timeslice` operator uses the metadata field `_messagetime` to organize the logs by slices. In your query, you need to specify the `timeslice` operator before the `join`, because the `_messagetime` field will no longer exist after the join is performed.

When you add the `timeslice` before the `join`, each of the tables created by the join will include a `_timeslice` field.

You can reference the table's `_timeslice` field to use in your group by operation. The name of the table is appended to the table's fields.

## Examples

### Join stream events by timeslice

If your table is named *errors*, your field would be `errors__timeslice`. (Notice that the name contains two underscores.)

```sumo
*
| timeslice 1h
| join
(parse "starting stream from * " AS streamId) AS table1,
(parse "starting search from parent stream * " AS streamId) AS table2
on table1.streamId = table2.streamId
| count table1_streamId, table1__timeslice
| formatDate(fromMillis(table1__timeslice ), "MM/dd/yyyy HH:mm:ss z") as timeslice
```

### Join login and logout events by 15-minute intervals

```sumo
_sourceCategory=auth
| timeslice 15m
| join
(parse "user=* logged in" as user) as logins,
(parse "user=* logged out" as user) as logouts
on logins.user = logouts.user
| count logins_user, logins__timeslice
```