Splunk – Earliest – Latest

src_ip=IP
| stats count earliest(_time) AS Earliest, latest(_time) AS Latest by src_ip dest_ip action wanin wanout lanin lanout 
| eval Earliest=strftime(Earliest,"%Y-%m-%d %H:%M:%S") 
| eval Latest=strftime(Latest,"%Y-%m-%d %H:%M:%S")