What command? Latest removes important duplicates, but stats helps me match missing fields.

[user93]

source A : filename,title,version,type,date
source B: filename,date
I want to compute the title field for source b and output that into my data where the file name has the same value for source A and B.
Goal: source=b | table _time,filename,title

My current approach is to use the stats latest(field) as field by filename to match the missing fields. However, after some analysis, I realise that I need all of the events and not only the latest. Some cases in each source may appear more than once and I need to monitor that.

Is there a better command?

[FrankVl]

Try this:

| eventstats values(title) by filename

[user93]

No, this does not work becuse now I lose the functionality of the by clause in the stats latest command.

Here with eventstats values command, both sources are include in the same results, but the source without the filename does not populate with the filename field.

Could be something I did wrong?

[FrankVl]

No, you're right, it just adds the title to all rows with the same filename. You can then filter for the relevant source, to get just those rows, which I indeed forgot to mention in my answer).