@javiergn  Sorry about the query, formatting was bad I have another query from the below table,  I have two rows and have to display in one row with the below conditions where  1. Guid have to match 2. Starttime must be the oldest 3. Endtime must be latest expected table to be  splunkAutomationTag guid startTime endTime totalTestPassed totalTestFailed totalTestInconclusive TestsPassed Client_ReleaseChecklist_Staging_Platform_Desktop_Chrome_9.15.0.1568_359 17796259-7592-4b13-8c30-a2b548d422f1 2020-06-13T19:10:30.783 2020-06-13T19:13:38.087 7 4 0 0     ... View more

Assuming you still have the _time field in the base search, then, on the assumption that the where clause test applies to the data prior to evaluating latest, then   | where (resultMessage=="null") OR (Status=="Fail") | table _time testName Status executed resultMessage | stats latest(*) as * by testName   will pick the latest one for each testName.  If you do not have _time, then you can create time from the 'executed' field with   | eval _time=strptime(executed, "%F %T.%Q")    before the table statement. Note that your original resultMessage test was wrong as it is checking for =="null" AND NOT - so it will always be true, so you will need to correct according to your requirements. I have removed the redundant part above. ... View more