To use the latest function of the stats command, you need a _time field. So, for each log, you probably want to create that field with an eval statement, leveraging the strptime command base search to pull logs in... | eval _time=strptime(dv_sys, "%Y-%m-%d H:M:S") | stats latest(number) as latestNumber by _time You'll likely need to play with the dv_sys strptime extract using the common variables found here: https://docs.splunk.com/Documentation/Splunk/8.0.0/SearchReference/Commontimeformatvariables, but this should generally get you what you're going for. If you already have a _time field on each log, then you can just ignore the eval command and go straight to the stats. Does this answer your question? ... View more