I gave it a try, changed it in two places (corrected typo in max maxExecutionTime and changed by endpoint to by timeWindow). index = myindex | bucket span=30m _time as timeWindow | eventstats max(executionTime) as maxExecutionTime by timeWindow | where executionTime=MaxExecutionTime | table timeWindow _time endpoint maxExecutionTime | convert ctime(timeWindow)   Now works like a charm 🙂 Thank you! ... View more