[rules-users] Matching time diff