I would like to create a table that displays the first and last event from a duplicate set of events.  A duplicate run may be interrupted by a non-duplicate event in which case I also want to the display the first and last message when the duplicate events appear again. For example, consider this list of events   | makeresults count=10 | streamstats count | eval _time=1599978591-(count*60) | eval Message = case(count=10, "MessageA", count=9, "MessageA", count=8, "MessageA", count=7, "MessageB", count=6, "MessageB", count=5, "MessageB", count=4, "MessageA", count=3, "MessageA", count=2, "MessageA", count=1, "MessageB") | reverse | table _time, Message   which will create a table similar to: _time Message 2020-09-13 06:19:51 MessageA 2020-09-13 06:20:51 MessageA 2020-09-13 06:21:51 MessageA 2020-09-13 06:22:51 MessageB 2020-09-13 06:23:51 MessageB 2020-09-13 06:24:51 MessageB 2020-09-13 06:25:51 MessageA 2020-09-13 06:26:51 MessageA 2020-09-13 06:27:51 MessageA 2020-09-13 06:28:51 MessageB   Now, I would like to display the first and last time a message is seen, removing any duplicates.. but it needs to consider that the same message may be seen again in another sequence and should be considered a different run to be displayed. I thought of adding this   | stats earliest(_time) as Earliest, latest(_time) as Latest BY Message | eval FirstEvent=strftime(Earliest,"%+"), LastEvent=strftime(Latest,"%+") | table FirstEvent, LastEvent, Message   but it doesn't take into account that there may be multiple sequences of repeated events so it generates FirstEvent LastEvent Message Sun Sep 13 06:19:51 UTC 2020 Sun Sep 13 06:19:51 UTC 2020 MessageA Sun Sep 13 06:22:51 UTC 2020 Sun Sep 13 06:22:51 UTC 2020 MessageB But what I desire is the following output FirstEvent LastEvent Message Sun Sep 13 06:19:51 UTC 2020 Sun Sep 13 06:21:51 UTC 2020 MessageA Sun Sep 13 06:22:51 UTC 2020 Sun Sep 13 06:24:51 UTC 2020 MessageB Sun Sep 13 06:25:51 UTC 2020 Sun Sep 13 06:27:51 UTC 2020 MessageA Sun Sep 13 06:28:51 UTC 2020 Sun Sep 13 06:28:51 UTC 2020 MessageB Any help is extremely appreciated.  Thanks in advance. Roger Cruz ... View more