Why is my search returning error?

[parkz]

I'm trying to run the following commands on an index:

| eval elast=strptime(lastSeen,"%Y-%m-%d %H:%M:%S")
| eval daysSinceLastSeen = round((now() - elast)/86400, 1) ```Calculate days elapsed since lastSeen```
| eval active_status = if ((latest (daysSinceLastSeen) <= 28), "active", "inactive")

There is an error that keeps popping up stating 'latest' function is unsupported or undefined.

How do I correct that?

[richgalloway · Accepted solution]

The latest function can be used with the chart, mstats, stats, timechart, and tstats commands, but not with eval.

latest doesn't make sense in this context since any given event will have a single daysSinceLastSeen field so it must be the latest one.  Finding the latest value of a field across all events requires an aggregating command like stats.