Hi Everyone, I am trying to write a query that will allow me to use my notable_events table, display the time the notable opened and the time it was closed. Looking through the forums I found: |eval _time=strftime(_time,"%Y/%m/%d %T") |eval review_time=strftime(review_time,"%Y/%m/%d %T") |eval assign_time = case(isnotnull(owner), _time) | eval close_time = case(status=5, review_time) |stats min(_time) as notable_time min(assign_time) as assign_time min(close_time) as close_time by AlertTitle,owner  But that isn't quite working as it returns 0 results. ... View more