With a query like the following (I've simplified it a little here and renamed some fields) index="my-test-index" project="my-project" | eval _time = strptime(my_timestamp, "%Y-%m-%dT%H:%M:%S.%N+00:00") | stats latest(my_timestamp) latest(_time) latest(my_count) as my_count by project I see behaviour that surprised me: 1. If I repeatedly issue the query, the value of my_count varies 2. It appears the rows from which my_count is taken are always those without a _time value resulting from the eval in my query (because either `my_timestamp` did not match the strptime format, or that field was not present when the record was ingested into splunk -- my data has both cases) 3. In the output of the search, the value of my_timestamp returned does not always come from the same ingested record as my_count. 4. In fact, the value of my_timestamp in the search output is always taken from the same single record: it doesn't change when I repeatedly issue the query. I guess 1. and 2. are because "null" (or empty or some similar concept) _time values aren't really expected and happen to sort latest. I guess 3. is because function `latest` operates field-by-field, and is not selecting a whole row -- combined again with the fact that some _time values are null. 4. I don't understand, but perhaps is a coincidence and is not reliably true in general outside of my data set etc., I'm not sure. What I really want is to find the ingested record with the latest value of `my_timestamp` for a given `project`, so I can present fields like `my_count` by `project` in a "most recent counts" table. I don't really want to operate on individual fields' "latest" values as in the query above, but rather latest entire records. How can I best achieve that in splunk? ... View more