correlate-with-outer-join-and-calculate-timestamp-difference

let AlertLogs = _GetWatchlist("AlertLogs")
| extend AlertDateTime = todatetime(strcat(AlertDate, AlertTime))
| project AlertDateTime, AlertName, UID;
let JunosLogs = _GetWatchlist("JunosLogs")
| extend JunosDateTime = todatetime(strcat(Date, Time))
| project JunosDateTime, Action, UID=UID_;
// JunosLogs
AlertLogs
| join kind=leftouter JunosLogs on UID
| sort by AlertDateTime
| summarize arg_max(AlertDateTime, JunosDateTime, *) by UID
| where abs(datetime_diff('minute', AlertDateTime, JunosDateTime)) > 5 or isempty(JunosDateTime)