Why are both of my new time fields are coming out as being the same when using streamstats?

[tb5821]

I'm running my search over the last 7 days and attempting to get the earliest time along with the value of the count field and the latest time along with the value of the count field. but both my new time fields are coming out as being the same! What am I doing wrong?

<search>
    | streamstats earliest(count) as earliest_count by namespace 
    | streamstats earliest(_time) as earliest_time by namespace
    | streamstats latest(_time) as latest_time by namespace
    | streamstats latest(count) as latest_count by namespace
    | where latest_count=earliest_count 
    | eval l_time=strftime(latest_time,"%m/%d/%y %H:%M:%S")
    | eval e_time=strftime(earliest_time,"%m/%d/%y %H:%M:%S")
    | eval time_since_last = e_time - l_time  
    | fieldformat time_since_last = tostring(time_since_last, "duration")

[renjith_nair · Accepted solution]

@tb5821,

Try eventstats and you could do that in single stretch

     | eventstats earliest(count) as earliest_count,earliest(_time) as earliest_time,latest(_time) as latest_time,streamstats latest(count) as latest_count by namespace 
     | where latest_count=earliest_count 
     | eval l_time=strftime(latest_time,"%m/%d/%y %H:%M:%S")
     | eval e_time=strftime(earliest_time,"%m/%d/%y %H:%M:%S")
     | eval time_since_last = e_time - l_time  
     | fieldformat time_since_last = tostring(time_since_last, "duration")