Hi, so I am trying to record the Earliest connection for IP addresses and the Latest connection for IP addresses however when trying to use both the earliest(_time) and latest(_time) command it seems that my latest(_time) command is overwriting my earliest(_time) value. Any reason for why this is happening and a potential fix? My code is as follows: | datamodel Network_Traffic All_Traffic search | search  All_Traffic.src_ip="172.18.*" OR All_Traffic.src_ip="172.19.*" OR All_Traffic.src_ip="172.20.*" OR | dedup All_Traffic.src_ip | eventstats earliest(_time) AS Earliest, latest(_time) as Latest by All_Traffic.src_ip | eval Earliest = strftime(Earliest,"%m/%d/%Y:%H:%M:%S") | eval Latest = strftime(Latest, "%m/%d/%Y:%H:%M:%S") | table All_Traffic.src_ip  Earliest Latest   ... View more