https://community.splunk.com/t5/Splunk-Search/Why-is-my-search-returning-error/m-p/591972#M206060 <P>I'm trying to run the following commands on an index:</P> <P>&nbsp;</P> <LI-CODE lang="markup">| eval elast=strptime(lastSeen,"%Y-%m-%d %H:%M:%S") | eval daysSinceLastSeen = round((now() - elast)/86400, 1) ```Calculate days elapsed since lastSeen``` | eval active_status = if ((latest (daysSinceLastSeen) &lt;= 28), "active", "inactive")</LI-CODE> <P>&nbsp;</P> <P>There is an error that keeps popping up stating 'latest' function is unsupported or undefined.</P> <P>How do I correct that?</P> Fri, 01 Apr 2022 16:33:27 GMT parkz 2022-04-01T16:33:27Z https://community.splunk.com/t5/Splunk-Search/Why-is-my-search-returning-error/m-p/591972#M206060 <P>I'm trying to run the following commands on an index:</P> <P>&nbsp;</P> <LI-CODE lang="markup">| eval elast=strptime(lastSeen,"%Y-%m-%d %H:%M:%S") | eval daysSinceLastSeen = round((now() - elast)/86400, 1) ```Calculate days elapsed since lastSeen``` | eval active_status = if ((latest (daysSinceLastSeen) &lt;= 28), "active", "inactive")</LI-CODE> <P>&nbsp;</P> <P>There is an error that keeps popping up stating 'latest' function is unsupported or undefined.</P> <P>How do I correct that?</P> Fri, 01 Apr 2022 16:33:27 GMT https://community.splunk.com/t5/Splunk-Search/Why-is-my-search-returning-error/m-p/591972#M206060 parkz 2022-04-01T16:33:27Z https://community.splunk.com/t5/Splunk-Search/Why-is-my-search-returning-error/m-p/591980#M206064 <P>The latest function can be used&nbsp;with the <FONT face="courier new,courier">chart, mstats, stats, timechart</FONT>, and <FONT face="courier new,courier">tstats</FONT> commands, but not with <FONT face="courier new,courier">eval</FONT>.</P><P><FONT face="courier new,courier">latest</FONT> doesn't make sense in this context since any given event will have a single daysSinceLastSeen field so it must be the latest one.&nbsp; Finding the latest value of a field across all events requires an aggregating command like <FONT face="courier new,courier">stats</FONT>.</P> Fri, 01 Apr 2022 16:49:03 GMT https://community.splunk.com/t5/Splunk-Search/Why-is-my-search-returning-error/m-p/591980#M206064 richgalloway 2022-04-01T16:49:03Z