Answer by warren for Grouping data in a sorted list

Try something like this:

index=ndx sourcetype=srctp server=* 
| stats min(_time) as First max(_time) as Last count as Events by server
| rename server as Server
| eval First=strftime(First,"%c"), Last=strftime(Last,"%c")
| table First Last Events Server

Should give you a table like the following:

First    | Last     | Events | Server
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
<time>   | <time>   | 7      | serverA

Etc

from User warren – Stack Overflow https://stackoverflow.com/questions/66738922/grouping-data-in-a-sorted-list/66746403#66746403
via IFTTT