I'm trying to create a query that basically says:   Show me events that contain A, B, C or D where the latest is A or B.   I believe I  could do this with a subsearch: "A" or "B" randomfield=X [search ("A" or "B" or "C" or "D") randomfield=X | head 1] I know the first part pulls the right data, and the 2nd part pulls the right data, I just can't get them both to return the one result that I want.   I also tried this as a transaction: "A" OR "C"randomfield=X | transaction startswith="A" endswith="C" keepevicted=t | search closed_txn=0 | stats count by randomField   But I realized there are more than just one possible start and one possible end.   I just want to make sure that the LAST result from a list of specific events is a smaller list of specific events.   Thanks! ... View more