Why is my search not returning results for the latest events per index?

[johannrenck]

Hi,

I have 3 indexes that get updated with the same date. They are all a snapshot of pre production config data that gets updated twice per day. Running the following gives me the last date:

index=*  Date < a | stats max(Date)

But if I try to run the following it doesn't return anything:

index=* [search index=*  Date < a | stats max(Date)] | stats count by index,Date 

What Am I missing?

The < a is because some data in the Date field gets wrongly created using the column header "Date"

Thanks,

Johann

[johannrenck · Accepted solution]

Ok, found the answer

index=* [search index=*  Date < a | stats max(Date) as Date] | stats count by index,Date

As Date solved the issue...