with prev_timestamp as (
       select
         timestamp as t
       from unified_log where
         timestamp > -1 and
         max_rows = 1
     ),
     filtered_log as (
       select * from unified_log where
         timestamp > (select t from prev_timestamp) and
         subsystem = 'com.apple.securityd' and 
         max_rows = 10000
       union all
       select * from unified_log where
         timestamp > (select t from prev_timestamp) and
         subsystem = 'com.apple.Authorization' and
         max_rows = 10000
     ),
     next_timestamp as materialized (
       select timestamp as t from unified_log where
       timestamp > -1 and
       max_rows = 1 and
       timestamp >= (select max(timestamp) from filtered_log)
     )
select next_timestamp.t, subsystem, count(*) from filtered_log left join next_timestamp group by subsystem;