https://community.splunk.com/t5/Splunk-Search/Table-command-versus-stats-command-for-this-search-for/m-p/299219#M90182 <P>My Query is as follows <BR /> index=x source=y COMPLETED <BR /> | stats values(process_key) as "Process Key", values(process_start_time) as "Process Start Time", values(job_key) as "Job Key", latest(job_status) as "Job Status" latest(process_status) as "Process Status",values(total_run_duration) as "Process Duration", values(duration_process_inprogress) as "InProgress Duration", values(job_detail_lastupdate) as "Last Update Time" by process_key,process_name,job_detail_key <BR /> | rename process_name as "Process Name" <BR /> | table "Process Start Time", "Last Update Time", "Process Name", "Process Key", "Job Key" "Process Status" "Job Status" "Process Duration" "InProgress Duration" <BR /> | sort -"Process Start Time" <BR /> | fillnull "Process Duration" value=Opened</P> Tue, 29 Sep 2020 16:11:49 GMT delgendy 2020-09-29T16:11:49Z https://community.splunk.com/t5/Splunk-Search/Table-command-versus-stats-command-for-this-search-for/m-p/299219#M90182 <P>My Query is as follows <BR /> index=x source=y COMPLETED <BR /> | stats values(process_key) as "Process Key", values(process_start_time) as "Process Start Time", values(job_key) as "Job Key", latest(job_status) as "Job Status" latest(process_status) as "Process Status",values(total_run_duration) as "Process Duration", values(duration_process_inprogress) as "InProgress Duration", values(job_detail_lastupdate) as "Last Update Time" by process_key,process_name,job_detail_key <BR /> | rename process_name as "Process Name" <BR /> | table "Process Start Time", "Last Update Time", "Process Name", "Process Key", "Job Key" "Process Status" "Job Status" "Process Duration" "InProgress Duration" <BR /> | sort -"Process Start Time" <BR /> | fillnull "Process Duration" value=Opened</P> Tue, 29 Sep 2020 16:11:49 GMT https://community.splunk.com/t5/Splunk-Search/Table-command-versus-stats-command-for-this-search-for/m-p/299219#M90182 delgendy 2020-09-29T16:11:49Z https://community.splunk.com/t5/Splunk-Search/Table-command-versus-stats-command-for-this-search-for/m-p/299220#M90183 <P>looking over your code, it looks pretty good. you can remove values(process_key) as "Process Key" since you are also using that in your by statement. You can use <CODE>fields</CODE> instead of <CODE>table</CODE>, if you're just using that to get them in the right order. </P> <PRE><CODE>| stats values(process_start_time) as "Process Start Time", values(job_key) as "Job Key", latest(job_status) as "Job Status" latest(process_status) as "Process Status",values(total_run_duration) as "Process Duration", values(duration_process_inprogress) as "InProgress Duration", values(job_detail_lastupdate) as "Last Update Time" by process_key,process_name,job_detail_key | rename process_name as "Process Name" process_key as "Process Key" </CODE></PRE> Fri, 06 Oct 2017 13:35:37 GMT https://community.splunk.com/t5/Splunk-Search/Table-command-versus-stats-command-for-this-search-for/m-p/299220#M90183 cmerriman 2017-10-06T13:35:37Z