If you use the
values() aggregation function, it will sort them alphabetically but if you use the
list() aggregation function, it will preserve the order of the events at the point you called
Please expand more. Based on what little you've provided, try this:
|stats value(status) latest(_indextime) as _indextime latest(_time) as _time by time, id | convert ctime(_indextime) as indextime | convert ctime(_time) as _time
| stats value(status) as statuses latest(_time) as _time by id | sort _time
You haven't provided enough information for us to help you. Can you provide a snippet of censored data and what you'd like the output to look like?