How do I locate the latest event and have all the fields in that event available to me?

[smaloney99]

I am using the following query to locate the latest event with the field EVENTREF = 50184 or 50185. I believe the correct event is being returned by the stats command but it is not returning all the fields in the returned event for reporting purposes.

Any suggestions?

EVENTREF=50184 OR EVENTREF=50185 | stats latest(EVENTREF) as LatestEvent by TVMREF

[richgalloway · Accepted solution]

Try this

EVENTREF=50184 OR EVENTREF=50185 | stats latest(EVENTREF) as LatestEvent, values(EVENTREF) as Events by TVMREF

[smaloney99]

Thank you! Using 'values' for any field I'd like to access is doing the trick.

[richgalloway]

Please accept the answer.