I am not able to get the latest (or earliest) _time values using mstats.
| mstats sum(bytes) latest(_time)
where index=metrics_app_dest_survey by app_name
Misunderstanding on my part. I thought we could get the earliest/latest time value. Now I see that latest()/earliest() are for the metric value not _time value.
In 7.2 there are new time functions latest_time() and earliest_time() that get the time values.
View solution in original post
You can get latest(_time), the screenshot you shared shows latest(time) as column name. It should be latest(_time) unless you are renaming _time to time