How to get the latest name from the data?

[ramesh12345]

Hi,

index=os  sourcetype=Service status=* (Group="Data" OR Group="Secur") AND (Section="Local" OR Section="data health") AND (Component="connectivity" OR Component=" care health")
| dedup _time| where Created_ON=Updated_ON
| eval days = (Now() - _time) /86400|eval days_ago = case(days>60, "2-3months",days< 60 AND days > 30, "1-2 months",days< 28 AND days > 14, "2-4 weeks",days< 14 AND days > 7, "1-2 weeks",days< 7 AND days > 5, "5-7days", days < 5 AND days > 2, "2-5 days", days < 2 AND days > 1, "2 Days", days < 1, "Less than 1 Day") 
| eventstats latest(Group) as LatestGroup by Case | chart count by days_ago,LatestGroup | sort days_ago

I want to display the latest group name,but it is not displaying the latest group name.How to do this?

[briancronrath]

Keep in mind latest only cares about _time so whatever calculations you are doing with the "days" field is not going to be factored in using that function. You may instead want to use the "last" function and specifically sort by the days field if that is your desired field for determining the "latest" group.