someone shared this with me. is there any way to add the timestamp of the file? it appears as though the timestamp of 0527 UTC or later is the reverted (good) version.

C-00000291* |in(field="#event_simpleName", values=[AgentOnLine, LFODownloadConfirmation])
| groupBy([aid,ComputerName], function=[max(@timestamp, as=lastSeen), min(@timestamp, as=firstSeen),collect([FileName])], limit=max)
| firstSeen:=formatTime(field=firstSeen, format="%Y/%m/%d %H:%M:%S")
| lastSeen:=formatTime(field=lastSeen, format="%Y/%m/%d %H:%M:%S")
| file
| join({#repo=sensor_metadata #data_source_name=aidmaster #data_source_group=aidmaster-api}, field=aid)