Formatting outputs of latest events in multiple sourcetypes possible?

[rome75]

Hello, I am trying to take a search like this
index=public sourcetype=public1* OR sourcetype=public2* newyork* earliest=60m@m | convert ctime(_time) as time | stats latest(time) by device, sourcetype

device              sourcetype       latest(time)
newyorkdevice1      public1         11/10/2019 00:32:00.000
newyorkdevice1      public2         11/10/2019 00:32:00.000
newyorkdevice2      public1         11/10/2019 00:32:00.000
newyorkdevice2      public2         11/10/2019 00:32:00.000

and get an output like this

device          public1                     public2
newyorkdevice1    11/10/2019 00:32:00.000        11/10/2019 00:32:00.000
newyorkdevice2    11/10/2019 00:32:00.000        11/10/2019 00:32:00.000

Any help or advice is appreciated

[renjith_nair · Accepted solution]

@rome75,

Try chart command

index=public sourcetype=public1* OR sourcetype=public2* newyork* earliest=60m@m
|chart latest(_time) as _time over device by network

[rome75]

Thank you for steering me in the right direction. I used chart and got the output I was looking for.

| convert ctime(_time) as time 
 | chart latest(time)  by device, sourcetype

 device    sourcetype_A        sourcetype_B
 newyorkdevice1    11/10/2019 00:32:00.000        11/10/2019 00:32:00.000
 newyorkdevice2    11/10/2019 00:32:00.000        11/10/2019 00:32:00.000