Hello, I wish to know the functional difference (if any) between the following: | tstats count FROM datamodel=Endpoint.Processes where Processes.user=SYSTEM by _time span=1h Processes.dest ... And | tstats count FROM datamodel=Endpoint.Processes where Processes.user=SYSTEM by Processes.dest ... | bin _time span=1h I understand the function and that "| bin" would always be used for a non tstats search, but within tstats is there any reason to place the "span" within the "by", or is it just cleaner/slightly faster? Thanks in advance! ... View more