Much of what you are doing does not make much sense. The initial dedup will give you exactly one record for each host and package, so all the following logic that presumes there is anything to count, or any MV in the records, is not needed. The latest() aggregate function for stats will pull you the last value, so you don't even have to dedup. So, this gets you the equivalent output of what you wrote. tag=Windows_Update package=* host=*
| fields host package eventtype
| stats latest(_time) as _time latest(eventtype) as eventtype by host package
| eval status=case(eventtype=="Update_Successful", "Successful at ("._time.")",
eventtype=="Update_Failed", "Failed at ("._time.")",
true(),"NA")
| table host package status Now, if you wanted a history, including the last value, then you could do something like this: tag=Windows_Update package=* host=*
(eventtype=="Update_Successful" OR eventtype=="Update_Failed")
| fields host package eventtype
| eval status=case(eventtype=="Update_Successful", "Successful at ("._time.")",
eventtype=="Update_Failed", "Failed at ("._time.")")
| sort 0 host package - _time
| stats latest(status) as Last_Status list(status) as Status_History by host package
... View more