I assume that there is a typos in your MaxPeakTPS in the eventstats command and your use of peakTPS in the following stats and also the use of peakTime, which does not exist as a field. You can do this | timechart span=1s count AS TPS ``` Calculate min and max TPS ``` | eventstats max(TPS) as max_TPS min(TPS) as min_TPS ``` Now work out average TPS, actual min and max TPS and then the first occurrence of the min/max TPS ``` | stats avg(TPS) as avgTPS values(*_TPS) as *_TPS min(eval(if(TPS=max_TPS, _time, null()))) as maxTime min(eval(if(TPS=min_TPS, _time, null()))) as minTime | fieldformat maxTime=strftime(maxTime,"%x %X") | fieldformat minTime=strftime(minTime,"%x %X") The min(eval... statements just look for the first _time when TPS is either min or max to get the earliest time when these occurred. Note the use of field naming conventions min_TPS/max_TPS that allows the use of wildcards in the stats.   ... View more