Hello All,  I need some help please.    I would like to query for the last upddate.  However, the field belegtyp and pdid can also change.   I need the last upddate for them all ( last upddate when belegtyp for pdid change).  Thats my query:  | eval crdate=strptime(crdate,"%Y-%m-%d") | eval crdate=strftime(crdate,"%Y-%m-%d") | eval upddate=strptime(upddate,"%Y-%m-%d") | eval upddate=strftime(upddate,"%Y-%m-%d") | search belegnummer=177287 | stats last(upddate) by upddate crdate belegnummer belegtyp pdid   It hasn´t work so far with | sort -upddate | stats last (upddate) by ... | stats first (upddate) by...   I don't know why it doesn't work.  Hope to get some help on this, thanks in advance.  ... View more