Missing values in results

[Jakfarh]

I found this very usefull search for a dashboard on gosplunk:

| rest /services/data/indexes | dedup title | fields title | rename title AS index 

    | map maxsearches=1500 search="| metadata type=sourcetypes index=\"$index$\"

    | eval Retention=tostring(abs(lastTime-firstTime), \"duration\")

    | convert ctime(firstTime) ctime(lastTime)

    | sort lastTime

    | rename totalCount AS \"TotalEvents\" firstTime AS \"FirstEvent\" lastTime AS \"LastEvent\"

    | eval index=\"$index$\""

    | fields index  sourcetype TotalEvents FirstEvent LastEvent Retention

    | sort sourcetype

    | stats list(sourcetype) AS SourceTypes list(TotalEvents) AS TotalEvents list(FirstEvent) AS "First Event" by index

    | append [| rest /services/data/indexes | dedup title | fields title | rename title AS index]

    | dedup index | fillnull value=null SourceTypes TotalEvents "First Event" "Last Event" Retention | sort index | search index=* (SourceTypes=*)
However, when i first ran it, some of the "lastevent" values appeared correctly. Ever since then, "LastEvent" and "Retention" have allways been "Null". I cant figure out why i dont get any return values on these fields.

I got an error saying the limit on "list" command of 100 was surpassed. So i tried replacing "list()" with "values()" in the search, but the result is the same, just without the error. 

[ITWhisperer]

What is it you are trying to achieve?

Can you still get what you want if you try these changes?

    | sort 0 sourcetype

    | stats list(TotalEvents) AS TotalEvents list(FirstEvent) AS "First Event" by index, sourcetype

[Jakfarh]

Unfortunatly, i still get null values with these changes.

I'm trying to get a comprehensive dashboard, that shows every sourcetype, pr. index, with a first event time, and last event time, to see when we started logging events, and to see if we suddenly stop, or have an unusually large gap since last event. 
We want to set up an alarm to notify us, if an index havnt recieved an event of a specific sourcetype, within a given threshold of time. (Sorry if my english is slightly off here).

This specific dashboard is supposed to be a complete sort of dictionary over our indexes and sourcetypes