print latest and values of status in an order.

[sandeepmakkena]

I have some this like this

|stats value(status) by time, id

I want to print the latest time, values(status) in the order they got indexed or they happened by id.

Can someone help, Thanks!

[woodcock]

If you use the values() aggregation function, it will sort them alphabetically but if you use the list() aggregation function, it will preserve the order of the events at the point you called stats.

[jacobpevans]

Greetings @sandeepmakkena,

Please expand more. Based on what little you've provided, try this:

|stats value(status) latest(_indextime) as _indextime latest(_time) as _time by time, id
| convert ctime(_indextime) as indextime
| convert ctime(_time) as _time

Cheers,
Jacob

[sandeepmakkena]

Values(status) are printing in alphabetical order, I want them to be in the order of they occurred.

[jacobpevans]

 | stats value(status) as statuses latest(_time) as _time by id
 | sort _time

You haven't provided enough information for us to help you. Can you provide a snippet of censored data and what you'd like the output to look like?

[sandeepmakkena]

What you are saying will sort all the results but, not the status from values(status) output.

[jacobpevans]

See @woodcock 's answer