Why is eventstats causing incorrect values?

[EricLloyd79]

I have the query seen in the screenshot and it seems if I use eventstats it returns an incorrect value far larger than it should be for my summation of the difference of two values. If I use stats instead of eventstats, it works as expected.
Can anyone give me any insight why eventstats would be doing this?
Ive attached a screenshot using stats and one with eventstats.

(I need to use eventstats as this is a query for ITSI)

[Vijeta]

when you use - stats earliest() and latest by host, it is giving you one row per host with earliest and latest value of the fields you mentioned. If you use eventstats instead it will return you all the events from all the host with the earliest and latest value for that host added in each event. For example you have 4 hosts and each host has say 10 events then stats will result into 4 rows/events one for each host with the earliest and the latest value of the field mentioned. In case of eventstats it will give you all the 40 events, with the value of latest and earliest field in all the events based on the host. You should try running both the stats and eventstats command separately to see the difference. Also depending on your need you may need to use stats or eventstats or streamstats.