Hi Slawomir
Access Monitor generates a consolidated output data set, where actions with an identical value for CLASS, RESOURCE, ACCESS_PROFILE, USERID, INTENT, and all the FLAGS, are scraped into one record, and the Occurrences value shows how may events there were. With only 1 record, there is only one timestamp: the date/time of the last occurrence.
Of course, at the higher summary levels, the fist occurrence and last occurrence applies to multiple data sets (and multiple intent values) so you should see a difference between the columns, but at the deepest summary level, they are the same for 1 input data set. With multiple input ACCESS data sets, you should see different dates.
------------------------------
Rob van Hoboken
------------------------------