This has been immensely helpful for me as well! Do you know how you would select just the most recent OIDValue for each OID? For my examples I've got: main search | eval TransferResults = type ."=". status | stats values(TransferResults) by referenceId but each type has multiple statuses: IP=ERROR IP=SUCCESS NATIVE=ERROR NATIVE=SUCCESS X1=ERROR X1=SUCCESS and in this case, the most recent statuses are all =SUCCESS so I'm trying to show that. ... View more