@venkatasri thanks this worked for me " | eventstats max(order_id) as order_id by id " ... View more

if i use earliest and latest in the search, no results are shown, image attached. @inventsekar you're right, the logic of latest doesn't make sense but it doesn't influence the results. how search for earliest and latest using an inputlookup? ... View more

@_Mauro_Costa_    You ca try this also.     YOUR_SEARCH | eval t=mvzip(ipa_valor,pa_nome) |mvexpand t | eval ipa_valor=mvindex(split(t,","),0),pa_nome=mvindex(split(t,","),1) | chart values(ipa_valor) over id by pa_nome       Sample Search:     | makeresults | eval d= "id=3131202 ,pa_nome=\"MAC Address\",ipa_valor=\"D0765\"|id=3131266 ,pa_nome=\"ID De Projecto,Serial Number\",ipa_valor=\"PCW,CNJ\"|id=3131780 ,pa_nome=\"Serial Number,ID De Projecto\",ipa_valor=\"CNJ,PCW\" " | eval d=split(d,"|") | mvexpand d | eval _raw=d | kv | fields - d, _raw | eval ipa_valor=split(ipa_valor,","),pa_nome=split(pa_nome,",") | rename comment as "Upto Now is sample data only" | eval t=mvzip(ipa_valor,pa_nome) |mvexpand t | eval ipa_valor=mvindex(split(t,","),0),pa_nome=mvindex(split(t,","),1) | chart values(ipa_valor) over id by pa_nome       Thanks KV ▄︻̷̿┻̿═━一 If this reply helps you, an upvote would be appreciated. ... View more