How to perform regex on latest event?

[splunktest_]

I have a query statement like so

index=* "account balance:" | rex "blah blah account balance:(?P<balance>(\d{1,3}(,\d{3})*)+) " | table balance

And this works fine, but when I try to add `latest` In there, it gives no results.

index=* "account balance:" | stats latest() | rex "blah blah account balance:(?P<balance>(\d{1,3}(,\d{3})*)+) " | table balance

Why am I not able to perform regex on the latest event?

[to4kawa]

sample:

index=_internal | head 2
| rex "(?P<balance>(\d{1,3}(,\d{3})*)+)" | table balance
| eval note="no_stats"
| append [ search index=_internal | head 2 |stats latest(_time) as _raw
| rex "(?P<balance>(\d{1,3}(,\d{3})*)+)" | eval note="default_latest"]
| append [ search index=_internal | head 2 |stats latest(_time) as test
| rex field=test "(?P<balance>(\d{1,3}(,\d{3})*)+)" | eval note="rename_latest"]

rex extracts fields in _raw by default.  try field= option.

[richgalloway]

The latest() function requires an argument. Put a field name within the parentheses.