Streamstats with rex and multiple "by" fields

[RobK700000]

I am attempting to rex out some fields from a source log and then if FIELD1 changes in a 24 hour period when the other 4 FIELDS all remain the same then output that information. Basically we should only be issuing FIELD1 once every 24 hours and if we issue it more than once but the other fields are all the same during that time frame then we know something is wrong. Unfortunately I've been banging on this for a few hours and I cannot get it to work. Can anyone assist. Thanks 

index=<index> AND source="source.log"
| rex "\"field1\":\"(?<FIELD1>[^\"]*)\""
| rex "\"field2\":\"(?<FIELD2>[^\"]*)\""
| rex "\"field3\":\"(?<FIELD3>[^\"]*)\""
| rex "\"field4\":\"(?<FIELD4>[^\"]*)\""
| rex "\"field5\":\"(?<FIELD5>[^\"]*)\""
| fields FIELD1, FIELD2, FIELD3, FIELD4, FIELD5
| streamstats time_window=24h last(FIELD1) as prev_field_value by FIELD2,FIELD3,FIELD4,FIELD5
| where FIELD1 != prev_field_value
| fields prev_field_value
|table _time FIELD1 FIELD2 FIELD3 FIELD4 FIELD5

[ITWhisperer · Accepted solution]

Events will be processed reverse chronological order, so unless you resort them, you might want first rather than last

| streamstats time_window=24h first(FIELD1) as prev_field_value by FIELD2,FIELD3,FIELD4,FIELD5