If i only want to use the field "_time" of a log to get first and latest occurrence of an event, which commands should i use and why ?  ex: ... | stats earliest(_time) as firsttime latest(_time) as lasttime  ... or ...  | stats min(_time) as firsttime max(_time) as lasttime ...   Is there a case where i could get differents results ? ... View more