Hi, I am new to splunk, could you please help me with below SPL, I am trying to use stats and table command We have 4 entries for same incident, I need to pick earliest time. Index="monitoring" sourcetype="tool" incident_id=INC* | stats earliest(_time) as early | table "mc_host" "incident_id" "early" | convert ctime(early)   I am getting error if execute.     ... View more