https://community.splunk.com/t5/Splunk-Search/print-latest-and-values-of-status-in-an-order/m-p/481375#M134902 <PRE><CODE> | stats value(status) as statuses latest(_time) as _time by id | sort _time </CODE></PRE> <P>You haven't provided enough information for us to help you. Can you provide a snippet of censored data and what you'd like the output to look like?</P> Sat, 09 Nov 2019 02:09:25 GMT jacobpevans 2019-11-09T02:09:25Z https://community.splunk.com/t5/Splunk-Search/print-latest-and-values-of-status-in-an-order/m-p/481372#M134899 <P>I have some this like this </P> <PRE><CODE>|stats value(status) by time, id </CODE></PRE> <P>I want to print the latest time, values(status) in the order they got indexed or they happened by id. </P> <P>Can someone help, Thanks!</P> Sat, 09 Nov 2019 01:14:15 GMT https://community.splunk.com/t5/Splunk-Search/print-latest-and-values-of-status-in-an-order/m-p/481372#M134899 sandeepmakkena 2019-11-09T01:14:15Z https://community.splunk.com/t5/Splunk-Search/print-latest-and-values-of-status-in-an-order/m-p/481373#M134900 <P>Greetings @sandeepmakkena,</P> <P>Please expand more. Based on what little you've provided, try this:</P> <PRE><CODE>|stats value(status) latest(_indextime) as _indextime latest(_time) as _time by time, id | convert ctime(_indextime) as indextime | convert ctime(_time) as _time </CODE></PRE> <P>Cheers,<BR /> Jacob</P> Sat, 09 Nov 2019 01:56:21 GMT https://community.splunk.com/t5/Splunk-Search/print-latest-and-values-of-status-in-an-order/m-p/481373#M134900 jacobpevans 2019-11-09T01:56:21Z https://community.splunk.com/t5/Splunk-Search/print-latest-and-values-of-status-in-an-order/m-p/481374#M134901 <P>Values(status) are printing in alphabetical order, I want them to be in the order of they occurred.</P> Sat, 09 Nov 2019 02:05:31 GMT https://community.splunk.com/t5/Splunk-Search/print-latest-and-values-of-status-in-an-order/m-p/481374#M134901 sandeepmakkena 2019-11-09T02:05:31Z https://community.splunk.com/t5/Splunk-Search/print-latest-and-values-of-status-in-an-order/m-p/481375#M134902 <PRE><CODE> | stats value(status) as statuses latest(_time) as _time by id | sort _time </CODE></PRE> <P>You haven't provided enough information for us to help you. Can you provide a snippet of censored data and what you'd like the output to look like?</P> Sat, 09 Nov 2019 02:09:25 GMT https://community.splunk.com/t5/Splunk-Search/print-latest-and-values-of-status-in-an-order/m-p/481375#M134902 jacobpevans 2019-11-09T02:09:25Z https://community.splunk.com/t5/Splunk-Search/print-latest-and-values-of-status-in-an-order/m-p/481376#M134903 <P>What you are saying will sort all the results but, not the status from values(status) output.</P> Sat, 09 Nov 2019 03:05:35 GMT https://community.splunk.com/t5/Splunk-Search/print-latest-and-values-of-status-in-an-order/m-p/481376#M134903 sandeepmakkena 2019-11-09T03:05:35Z https://community.splunk.com/t5/Splunk-Search/print-latest-and-values-of-status-in-an-order/m-p/481377#M134904 <P>If you use the <CODE>values()</CODE> aggregation function, it will sort them alphabetically but if you use the <CODE>list()</CODE> aggregation function, it will preserve the order of the events at the point you called <CODE>stats</CODE>.</P> Sat, 09 Nov 2019 22:03:39 GMT https://community.splunk.com/t5/Splunk-Search/print-latest-and-values-of-status-in-an-order/m-p/481377#M134904 woodcock 2019-11-09T22:03:39Z https://community.splunk.com/t5/Splunk-Search/print-latest-and-values-of-status-in-an-order/m-p/481378#M134905 <P>See @woodcock 's answer</P> Wed, 13 Nov 2019 22:34:59 GMT https://community.splunk.com/t5/Splunk-Search/print-latest-and-values-of-status-in-an-order/m-p/481378#M134905 jacobpevans 2019-11-13T22:34:59Z