How to select values from not the current source but from the previous source

[PBerry7538]

So I know that the following will allow me to search and just to select values from the current sourcetype :

[search index= sourcetype="" | stats latest(source) as source | return source] < SPL QUERY>

But i would like to select values from the previous current source ( I am sorry if explaining badly) . Please could anyone help me with how I could do that.

Many Thanks

[PBerry7538]

@whrg
Thanks very much ! That worked a treat

[whrg · Accepted solution]

Try this:

[search index=...  sourcetype=... | dedup source | head 2 | reverse | head 1 | return source] < SPL-QUERY>

Alternatively:

[search index=... sourcetype=... | dedup source | streamstats count | search count=2 | return source] < SPL-QUERY>