How to create the table based on the specific time from latest(_time)?

[Splunker4]

I was trying to get the latest time from index=index1 sourcetype=source1

Below is the string:

 | tstats latest(_time) as lastTime where index=index1 sourcetype=source1 | eval lastTime=strftime(lastTime,"%x %X")

I will use this lastTime as the time-picker to have the table display for data inside source1. The purpose is to always get the data from last time query log in source1. Could anybody to tell me how to continue the string to make it?

[woodcock]

 | tstats max(_time) AS _time
where index=index1 sourcetype=source1
| eval Time = _time

[yuanliu]

Can you clarify the use case here?  If you want data from the last entry in source1 - which would be the latest for the vast majority of sources, wouldn't it be easier to simply "| tail 1"?  The phrase "time-picker" can be interpreted as an input on a dashboard.  If that is the case, your search serves the purpose already. (Although using a string for time-related input usually does not end well.)

If the source's time in the index is somehow scrambled, and you want to select the latest event, you can sort, then tail. "| sort _time | tail 1".  (Sorting raw events is expensive.  But I don't see a clean way out if index is already scrambled.)

Also note that latest(_time) is more expensive than max(_time).