How to pull latest event

[eb1929]

I have a search/dash board that will show data over the last 30 days, the search is as followed 

index=server EventCode=5829
| stats count by ComputerName, Domain, Machine_SamAccountName, Machine_Operating_System 

this search will give me roughly 70~ events a month, the problem is now my customer would like to have the time stamp put on the table, (which is easy by putting just the "_time" field in there) my problem that I am running into is that it will give me 10,000 results now! I showed the customer this and they said it would be fine for me to show just the latest event in the last 30 days for each Machine_SamAccountName. 

My question is how???? 

[richgalloway · Accepted solution]

Does this fulfill the requirements?

index=server EventCode=5829
| stats count, latest(_time) as _time by ComputerName, Domain, Machine_SamAccountName, Machine_Operating_System