Why is "stats latest(field) as FIELDNAME" not displaying any values under FIELDNAME in search results?

[jhampton_3rd]

My last stats command is not showing the values by sublocation. It shows each sublocation but no values are shown.

index=###### sourcetype=####### 
| lookup csirt_asset_list ip OUTPUT sublocation   
| search hasBeenMitigated=0 sublocation=*   
| stats dc(ip) as Total1 by sublocation
| join [ search index=##### sourcetype=##### pluginID<1000000 baseScore>0   
| lookup csirt_asset_list ip OUTPUT sublocation   
| search hasBeenMitigated=0 sublocation=* 
| stats dc(ip) as Total2 by sublocation] 
| join [search index=##### sourcetype=##### pluginID<1000000 baseScore>0   
| lookup csirt_asset_list ip OUTPUT sublocation   
| search hasBeenMitigated=0 sublocation=*   
| stats count as counted by baseScore, sublocation   
| fields + sublocation, baseScore, counted  
| sort-baseScore  
| lookup weight_lookup baseScore OUTPUT wmultiplier  
| eval aaa=(counted * wmultiplier) 
| eventstats sum(aaa) as test1, sum(counted) as test2
| eval bbb=(test1 / test2)  
| eval bbb=round(bbb,2)] 
| eval cvss_overall_score=bbb*(Total2/Total1) 
| stats latest(cvss_overall_score) as "CVSS Overall Score" by sublocation

OUTPUT LOOKS LIKE THIS

sublocation       CVSS Overall Score
abc
def
ghi

Nothing is showing under CVSS Overall Score. If I use:

| stats latest(cvss_overall_score) as "CVSS Overall Score"

It shows the CVSS Overall Score.

Thanks for your help

[sundareshr · Accepted solution]

latest() needs _time field, which is missing in your resultset. Try last() instead

[mew1033]

I tried evaling a _time field before running stats latest and it still didn't work. Is there some way I can force stats to recognize my new _time field?

[jhampton_3rd]

Thanks for your help. That worked!