https://community.splunk.com/t5/Splunk-Search/mstats-latest-time-not-working/m-p/423739#M121605 <P>You can get latest(_time), the screenshot you shared shows latest(time) as column name. It should be latest(_time) unless you are renaming _time to time </P> Tue, 29 Sep 2020 21:36:15 GMT Vijeta 2020-09-29T21:36:15Z https://community.splunk.com/t5/Splunk-Search/mstats-latest-time-not-working/m-p/423737#M121603 <P>I am not able to get the latest (or earliest) _time values using mstats.</P> <PRE><CODE>| mstats sum(bytes) latest(_time) where index=metrics_app_dest_survey by app_name </CODE></PRE> <P>is returning:</P> <P><span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/5912i8AAF20DD5BF8616E/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> Thu, 11 Oct 2018 16:02:43 GMT https://community.splunk.com/t5/Splunk-Search/mstats-latest-time-not-working/m-p/423737#M121603 simpkins1958 2018-10-11T16:02:43Z https://community.splunk.com/t5/Splunk-Search/mstats-latest-time-not-working/m-p/423738#M121604 <P>Misunderstanding on my part. I thought we could get the earliest/latest time value. Now I see that latest()/earliest() are for the metric value not _time value.</P> <P>In 7.2 there are new time functions latest_time() and earliest_time() that get the time values.</P> Tue, 29 Sep 2020 21:36:09 GMT https://community.splunk.com/t5/Splunk-Search/mstats-latest-time-not-working/m-p/423738#M121604 simpkins1958 2020-09-29T21:36:09Z https://community.splunk.com/t5/Splunk-Search/mstats-latest-time-not-working/m-p/423739#M121605 <P>You can get latest(_time), the screenshot you shared shows latest(time) as column name. It should be latest(_time) unless you are renaming _time to time </P> Tue, 29 Sep 2020 21:36:15 GMT https://community.splunk.com/t5/Splunk-Search/mstats-latest-time-not-working/m-p/423739#M121605 Vijeta 2020-09-29T21:36:15Z