Thanks Martin but if you look at my query I was already listing or trying the latest and it did not fix the problem. It sure looks like in this grouping that the last, first and latest functions are not working correctly. Here is how I fixed my problem and made the selection work correctly within the groups. index=caabistats | bucket span=1w _time | eval val1=replace( strptime(src_date, "%Y-%m-%d") + "," + tostring(total_found_devices), "Null", "0" ) | stats min(val1) as val1 by _time | rex field=val1 "\d+,(?\d+) | stats values(dev_count) as dev_count by _time | delta dev_count as dev_diff | timechart span="1w" values(dev_diff) as "Total Devices" Rowan ... View more