I ended up realizing that the crux valid time is the state of your data at that point. And realized that for what I was trying to do (create a monitoring app), the best thing was actually to create a document for the log, showing the current state for my application and then another document for the alert, which would become valid at a later point in time without intervention, telling me it's been too long since the app called in. Because that alert might be valid in the future, but isn't now, because it hasn't been long enough. In other words, if the app keeps working as expected, the alert should never exist. All this to say: I was trying to use crux like mongo, instead of using crux like crux and taking advantage of the design. Now my documents look like this: Event Log: {:crux.db/id :demo-app/log, :log/event "app-start", :log/time #time/instant "2020-03-23T02:08:30.161563Z", :app/name :demo-app, :app/await :demo-app/await, :await/next-event #time/instant "2020-03-23T02:09:30.161555Z"} Alert: (should probably be named alert, instead of await) {:crux.db/id :demo-app/await, :app/name :demo-app, :await/timestamp #time/instant "2020-03-23T02:08:30.161555Z"} And my query like this: (crux/q (crux/db db) '{:find [app timestamp status next-event] :where [[e :app/name app] [e :log/event status] [e :await/next-event next-event] [e :app/await await] [await :await/timestamp timestamp]]